Executive Summary
A critical unauthenticated remote code execution (RCE) vulnerability has been identified in Peyara Remote Mouse version 1.0.1. The application exposes a Socket.IO WebSocket service that lacks authentication, permitting any network-adjacent or remote attacker to send keyboard input events directly to the host system.
The attack involves establishing a WebSocket connection to the service on TCP port 1313 and transmitting specific Socket.IO event packets. These events simulate keyboard actions to open the Windows Start menu, launch a command prompt (cmd.exe), and type out a malicious payload—such as a PowerShell reverse shell—leading to full system compromise in the context of the running user.
This vulnerability is particularly high-risk as it bypasses standard authentication and allows for reliable, repeatable exploitation using publicly available Metasploit modules. Organizations using this remote management software should immediately restrict network access to port 1313 or decommission the software until a patch is applied.