CVE-2022-3218: WiFi Mouse Server client-side authentication bypass leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code and a Metasploit module available, and a very high EPSS score.

What it is

WiFi Mouse (Mouse Server) from Necta LLC relies on client-side authentication, so its authentication mechanism can be trivially bypassed. A bypassed attacker can then reach functionality that results in remote code execution. The flaw is remotely reachable without credentials, making it serious for any host running the server.

Impact

An unauthenticated remote attacker gains code execution on the machine running WiFi Mouse Server, giving full control of that host. This can lead to data theft, further lateral movement, or use of the host as a foothold.

Attack surface

Reached over the network via the WiFi Mouse Server service; the CVSS vector shows AV:N/PR:N/UI:N, so no authentication and no user interaction are required. The description does not specify the exact port or protocol details.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.74016, 99.458th percentile) and multiple references are tagged Exploit, including public PoC code and a Metasploit pull request, indicating public exploitation tooling exists.

What to do

• Patch or update WiFi Mouse Server to a fixed version if the vendor provides one; the record does not name a fixed version, so verify with Necta LLC.
• If no fix is available, remove or disable WiFi Mouse Server on hosts that do not require it.
• Restrict network access to the WiFi Mouse Server port to trusted hosts only, using host firewalls or network segmentation.
• Do not expose the service to untrusted networks or the internet.
• Monitor for and block the known public exploit code and Metasploit module activity against this service.

Detection

• Monitor network traffic to the WiFi Mouse Server port for unexpected or unauthorized clients, especially from outside expected management segments.
• Alert on process creation or command execution spawned by the WiFi Mouse Server process.
• Search for the public PoC script names or Metasploit module artifacts in logs, file systems, or network signatures.
• Baseline normal WiFi Mouse Server client connections and alert on new or anomalous source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.