What is the CVSS score of CVE-2025-66576?

CVE-2025-66576 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Remote Keyboard Desktop are affected by CVE-2025-66576?

Remote Keyboard Desktop 1.0.1 contains a critical vulnerability allowing unauthenticated attackers to execute arbitrary system commands on affected systems.

Is there a public PoC exploit available for CVE-2025-66576?

Yes, a public proof-of-concept exploit is available for CVE-2025-66576. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-66576?

Within 24 hours: Identify all systems running Remote Keyboard Desktop 1.0.1 and isolate them from production networks if operationally feasible; alert all relevant teams and stakeholders. Within 7 days: Implement network-level access controls restricting inbound connections to affected systems; disable Remote Keyboard Desktop 1.0.1 if business operations permit, or restrict to trusted internal networks only with additional authentication. Within 30 days: Migrate to an alternative remote desktop solution that is actively maintained and patched, or await a vendor security update and apply immediately upon release.

Remote Keyboard Desktop CVE-2025-66576

EUVD-2025-201265 CRITICAL

OS Command Injection (CWE-78)

2025-12-04 disclosure@vulncheck.com

Command Injection RCE Remote Keyboard Desktop

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201265

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

PoC Detected

Dec 17, 2025 - 16:21 vuln.today

Public exploit code

CVE Published

Dec 04, 2025 - 21:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.

Analysis

Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as OS Command Injection (CWE-78).

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.

CVE-2025-66576 vulnerability details – vuln.today

Back

Remote Keyboard Desktop CVE-2025-66576

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code