CVE-2021-47851
📋 TL;DR
Mini Mouse 9.2.0 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands via crafted HTTP requests to the /op=command endpoint. This affects all users running Mini Mouse 9.2.0 on any platform where the software is exposed to network access.
💻 Affected Systems
- Mini Mouse Remote Control
📦 What is this software?
Mini Mouse by Yodinfo
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal data, pivot to other systems, or establish persistent backdoors.
Likely Case
Attackers executing arbitrary commands to download and run malicious payloads, potentially leading to ransomware deployment or credential theft.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the vulnerable endpoint.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB, requiring only basic HTTP request crafting skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider removing or replacing Mini Mouse with alternative software.
🔧 Temporary Workarounds
Network Access Restriction
allBlock all network access to Mini Mouse using firewall rules
Windows: netsh advfirewall firewall add rule name="Block Mini Mouse" dir=in action=block program="C:\Path\To\MiniMouse.exe" enable=yes
Linux: iptables -A INPUT -p tcp --dport [Mini Mouse Port] -j DROP
Disable HTTP Endpoint
allConfigure Mini Mouse to disable network functionality or run in local-only mode
🧯 If You Can't Patch
- Immediately isolate affected systems from network access
- Implement strict network segmentation to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check if Mini Mouse version 9.2.0 is installed and running with network access enabled. Test by sending a crafted HTTP POST request to http://[target]:[port]/op=command with JSON payload.Check Version:
Check application version in About dialog or installation directory propertiesVerify Fix Applied:
Verify Mini Mouse is either removed, network access is blocked, or the software is no longer running.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /op=command endpoint
- Unusual process execution from Mini Mouse directory
- Network connections from Mini Mouse to external IPs
Network Indicators:
- HTTP POST requests containing JSON with command execution patterns
- Traffic to suspicious domains/downloads following Mini Mouse requests
SIEM Query:
source="*mini*mouse*" AND (uri="/op=command" OR method="POST")