H4Rk3Nz0

The software contains a remote code execution issue that allows attackers to execute arbitrary commands. An attacker can exploit the service by connecting to port `9512` and sending specially crafted network packets. This allows the attacker to open a command prompt and download and execute malicious payloads.

Remote Control Server, maintained by Steppschuh, allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and execute arbitrary commands, resulting in full system compromise.

The issue allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the "Remote upload endpoint".

The web management interface for Unified Intents' Unified Remote solution does not require authentication, allowing a remote, unauthenticated attacker to change or disable authentication requirements for the Unified Remote protocol. This can be leveraged to run code of the attacker's choosing. The issue is related to an incorrect authorization procedure in the web management interface.

The issue arises due to the WiFi Mouse (Mouse Server)'s reliance on client-side authentication, which allows its authentication mechanism to be easily bypassed. This bypass can lead to remote code execution.