What is CVE-2022-4978?

CVE-2022-4978 is a vulnerability in Steppschuh Remote Control Collection Server, classified under OS Command Injection. Published 2025-07-23.

Is CVE-2022-4978 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Steppschuh Remote Control Collection Server

CVE-2022-4978

Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and execute arbitrary commands, resulting in full system compromise.

Vulnerability class: Command Injection (OS Command Injection)

Published 2025-07-23 · last modified 2026-06-17.

EPSS exploit prediction

EPSS: 0.023 (82.3th percentile), scored 2026-10-02.

Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 82.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.016 · newest: 0.023 · change: +0.007

Affected products

Steppschuh Remote Control Collection Server — versions 3.1.1.12

Weakness classification (CWE)

Public proof-of-concept exploits

rapid7/metasploit-framework

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/w… (exploit)
remote-control-collection.com/ (product)
www.vulncheck.com/advisories/steppschuh-remote-control-server-unauth-rce (third-party-advisory)

Frequently asked questions

What is CVE-2022-4978?: CVE-2022-4978 is a vulnerability in Steppschuh Remote Control Collection Server, classified under OS Command Injection. Published 2025-07-23.
Is CVE-2022-4978 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.