A critical command injection vulnerability in Saturn Remote Mouse Server allows unauthenticated attackers to execute arbitrary commands on the host system.

The application fails to perform proper input validation or authentication for commands received via UDP port 27000. Attackers can send malformed packets containing malicious payloads that the service forwards directly to system execution functions, resulting in remote code execution under the context of the service account.

Successful exploitation of this vulnerability grants an attacker full control over the host system, facilitating unauthorized data access, lateral movement, or system disruption. Given the CVSS score of 8.4, this vulnerability represents a high risk to organizational security, particularly for environments where the service is exposed to the local network without strict segmentation.

Immediate Action: Since no official patch is currently identified, immediately restrict access to UDP port 27000 via host or network firewalls to prevent unauthorized packet submission.

Proactive Monitoring: Review system logs for unexpected child processes spawned by the Remote Mouse Server service and monitor network traffic on port 27000 for anomalous JSON-formatted UDP traffic.

Compensating Controls: Implement network segmentation to isolate the service from untrusted endpoints and ensure that the service runs with the least privileges necessary to reduce the potential impact of a successful compromise.

Public Exploit Available: Unknown

Organizations utilizing Saturn Remote Mouse Server must prioritize the immediate isolation of the affected service. Until a vendor-supplied patch is available, blocking network access to port 27000 is the most effective measure to mitigate the risk of remote command execution. Security teams should maintain heightened vigilance for any indicators of compromise related to this service.