CVE-2025-66576 is a critical (CVSS 9.8) OS command injection in Remote Keyboard Desktop 1.0.1, a Windows app that turns a phone into a keyboard. Remote attackers can run system commands without logging in. No fixed version is listed, so remove or isolate the app.
What's affected
Remote Keyboard Desktop version 1.0.1. The NVD record says a remote attacker can execute system commands through an exported function reached via rundll32.exe, with no authentication.
Severity differs by source. NVD scores the issue 9.8 (critical). VulnCheck, the CNA that published it, lists a CVSS v4 score of 8.9 and labels it high, and its vector includes a flag for proof of concept exploit maturity. The record also links an Exploit-DB entry. The CVE is not in CISA's Known Exploited Vulnerabilities catalog according to the record, so there is no confirmed exploitation in the wild, only public exploit material.
I could not confirm a patched version from any page I fetched. The VulnCheck advisory lists only 1.0.1 as affected.
How to check if you're exposed
This is desktop software, so exposure is a question of inventory and network reachability.
On Windows, list installed software and look for the app:
Get-Package -Name "*Remote Keyboard*"
Get-AppxPackage | Where-Object Name -like "*RemoteKeyboard*"
Then check whether the app is listening on any port and whether that port is reachable from other hosts:
netstat -ano | findstr LISTENING
Match the process ID to the app. If it listens beyond localhost on a laptop that joins public networks, treat the machine as exposed.
What to do now
- Find every machine that has Remote Keyboard Desktop installed, using your endpoint inventory.
- Uninstall it on machines that do not need it. This is the only complete mitigation I can support from the sources.
- Where it is required, block inbound access to the app with the host firewall and keep those hosts off untrusted networks.
- Check the vendor site and the Microsoft Store listing for an updated release, and confirm the fixed version in writing before relying on it.
- Treat any host that ran the app on an exposed network as potentially affected and review it for unexpected processes.
Why it matters
The weakness is CWE-78, improper neutralization of special elements used in an OS command. In plain terms, input that should be treated as data ends up interpreted as a command by the operating system. Because the entry point is reachable from the network and needs no credentials, a single exposed install can hand over control of the desktop it runs on.
Small utility apps like this often sit outside software inventory programs. They are installed by individuals, not by IT, and they rarely get a security contact or an update channel. That is why this one is worth a ten minute search of your fleet even though the product is niche. Public exploit material also lowers the skill needed to abuse it.
Quick check
Is there a patch?
None of the pages I fetched name a fixed version. Check the vendor site before assuming one exists, and uninstall the app in the meantime.
Is this exploited in the wild?
The record does not mark it as a CISA KEV entry. A public exploit exists, but that is not the same as confirmed exploitation.
Sources
Last reviewed: 18 October 2026.
