RCE in Steppschuh Remote Control Collection Server
CVE-2022-4978
Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and execute arbitrary commands, resulting in full system compromise.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.016 (72.7th percentile) — read the EPSS interpretation.
Affected products
- Steppschuh Remote Control Collection Server — versions 3.1.1.12
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2022-4978?
- CVE-2022-4978 is a vulnerability in Steppschuh Remote Control Collection Server, classified under OS Command Injection. Published 2025-07-23.
- Is CVE-2022-4978 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.