CVE-2022-3218

What it actually does

The application trusts authentication decisions made by the client instead of enforcing them on the server side. A remote, unauthenticated attacker who can reach the WiFi Mouse / Mouse Server network service can speak the expected control protocol directly, bypass authentication, and issue commands that may execute code on the host running Mouse Server. Because the service runs on a desktop system, successful exploitation can provide code execution in the context of the Mouse Server process or the logged-in user, enabling access to files, credentials, applications, and the local network.

Why it matters to the business

Compromise of a workstation running this software can lead to data theft, malware execution, credential capture, lateral movement, and disruption of user operations. The risk is high because exploitation is network-accessible, requires no credentials or user interaction, has a critical CVSS score, has a high EPSS likelihood, and is assessed as weaponized. Although it is not currently listed in CISA KEV, organizations should treat exposed instances as urgent due to the ease of exploitation and the product’s intended ability to remotely control a computer.

How an attack unfolds

An attacker first identifies a system running Necta WiFi Mouse / Mouse Server, typically by scanning for the application’s listening service on local networks, VPN-accessible networks, or internet-exposed hosts. Because authentication is enforced by the client rather than the server, the attacker does not need a valid password or pairing approval; they can connect directly to the service and send protocol messages that the server accepts as trusted input. The attacker then abuses the remote-control functionality to open applications, write files, launch commands, or invoke operating-system utilities. From there, they may download and execute a payload, establish persistence, collect credentials and documents, or move laterally using the compromised user’s access.

How to fix it

The safest remediation is to uninstall Necta WiFi Mouse / Mouse Server from systems where it is not strictly required. No fixed version was provided in the supplied data, so do not assume that an in-place upgrade fully remediates the issue unless the vendor explicitly documents a server-side authentication fix. Where the software must remain in use, restrict access to the Mouse Server listener using host firewalls, network firewalls, and segmentation so only trusted management devices can connect. Block exposure from the internet, guest Wi-Fi, untrusted VLANs, and broad VPN ranges. Run the software only under a least-privileged user account, disable auto-start if not needed, and monitor for suspicious child processes. If a vendor-fixed release becomes available, upgrade promptly and verify that authentication is enforced by the server, not just the client application.

How to confirm the fix worked

Confirm remediation by inventorying endpoints for WiFi Mouse / Mouse Server and verifying whether the application is removed, disabled, or updated to a vendor-confirmed fixed release. From a separate host, scan for the Mouse Server listening port and confirm it is not reachable from untrusted networks. Review local firewall policy to ensure inbound access is blocked or tightly allowlisted. Validate endpoint controls by checking that MouseServer.exe or equivalent product processes are not listening broadly and cannot spawn command interpreters or scripting engines during normal operation. If the product must remain installed, perform an authenticated administrative review of configuration, startup entries, running processes, and exposed network listeners.

Typical attack path

1. Scan networks for hosts exposing the WiFi Mouse / Mouse Server listening service.
2. Connect directly to the service without completing legitimate client authentication.
3. Send crafted WiFi Mouse protocol messages that the server accepts as authenticated control input.
4. Use the remote-control functionality to launch commands or programs on the host.
5. Execute a payload such as a reverse shell, downloader, credential theft tool, or remote access trojan.
6. Use the compromised workstation for data access, persistence, credential harvesting, or lateral movement.

How to detect it

Look for evidence that Mouse Server accepted network connections followed by abnormal process execution. Useful sources include EDR process telemetry, Sysmon Event ID 1 process creation, Sysmon Event ID 3 network connection, Windows Security Event ID 4688 process creation, Windows Defender or antivirus alerts, local firewall logs, NetFlow, VPN logs, DNS logs, proxy logs, and installed-software inventory. Focus on cases where MouseServer.exe or similarly named WiFi Mouse processes spawn cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, or unknown executables. Correlate inbound network connections to the Mouse Server listener with immediate child-process activity, file writes in user-writable directories, new startup items, scheduled tasks, or outbound connections to unfamiliar destinations. Because this flaw is an authentication bypass and may not produce explicit failed-login logs, absence of authentication failures is not reassuring. Also review systems exposing TCP port 1978 or other configured Mouse Server ports to untrusted networks.

• MouseServer.exe
• WiFi Mouse
• Mouse Server
• TCP/1978
• ParentImage=*MouseServer.exe* Image=*cmd.exe*
• ParentImage=*MouseServer.exe* Image=*powershell.exe*
• ParentImage=*MouseServer.exe* Image=*wscript.exe*
• ParentImage=*MouseServer.exe* Image=*cscript.exe*
• ParentImage=*MouseServer.exe* Image=*mshta.exe*
• ParentImage=*MouseServer.exe* Image=*rundll32.exe*
• ParentImage=*MouseServer.exe* Image=*regsvr32.exe*
• ParentImage=*MouseServer.exe* Image=*certutil.exe*
• ParentImage=*MouseServer.exe* Image=*bitsadmin.exe*
• ParentImage=*MouseServer.exe* Image=*curl.exe*
• ParentImage=*MouseServer.exe* Image=*wget.exe*
• EventCode=4688 ParentProcessName=*MouseServer.exe*
• EventID=1 ParentImage=*MouseServer.exe*
• EventID=3 Image=*MouseServer.exe*

What your security team should do

• Immediately identify all systems with Necta WiFi Mouse / Mouse Server installed or listening on the network.
• Remove the software from systems where it is not business-critical.
• Block inbound access to the Mouse Server service from the internet, guest networks, untrusted subnets, and broad VPN address ranges.
• Prioritize exposed instances for urgent remediation because the vulnerability is weaponized and has a high exploitation probability.
• Hunt for suspicious child processes launched by Mouse Server, especially command shells, scripting engines, downloaders, and remote access tools.
• Review firewall, EDR, Sysmon, Windows Security, proxy, DNS, and NetFlow logs for unusual inbound connections followed by process execution on affected hosts.
• If compromise is suspected, isolate the endpoint, collect forensic artifacts, rotate potentially exposed credentials, and assess lateral movement.
• Track vendor advisories and deploy a confirmed fixed version if one becomes available; otherwise maintain compensating controls or remove the product.