CVE-2025-66555 - Vulnerability Details - OpenCVE

AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://airkeyboardapp.com
https://apps.apple.com/us/app/air-keyboard/id6463187929
https://www.exploit-db.com/exploits/52333
https://www.vulncheck.com/advisories/airkeyboard-ios-app-105-remote-input-injection

History

Thu, 04 Dec 2025 21:00:00 +0000

Type	Values Removed	Values Added
Description		AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.
Title		AirKeyboard iOS App 1.0.5 - Remote Input Injection
Weaknesses		CWE-306
References		https://airkeyboardapp.com https://apps.apple.com/us/app/air-keyboard/id6463187929 https://www.exploit-db.com/exploits/52333 https://www.vulncheck.com/advisories/airkeyboard-ios-app-105-remote-input-injection
Metrics		cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2025-12-04T20:43:19.829Z

Updated: 2025-12-04T20:43:19.829Z

Reserved: 2025-12-04T15:58:16.582Z

Link: CVE-2025-66555

Vulnrichment

No data.

NVD

Status : Received

Published: 2025-12-04T21:16:09.573

Modified: 2025-12-04T21:16:09.573

Link: CVE-2025-66555

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-306

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66555", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-12-04T15:58:16.582Z", "datePublished": "2025-12-04T20:43:19.829Z", "dateUpdated": "2025-12-04T20:43:19.829Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "AirKeyboard iOS App", "vendor": "airkeyboardapp", "versions": [{"status": "affected", "version": "1.0.5"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Chokri Hammedi"}], "datePublic": "2025-06-13T00:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.</p>"}], "value": "AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-12-04T20:43:19.829Z"}, "references": [{"name": "Exploit Database Entry 52333", "tags": ["exploit"], "url": "https://www.exploit-db.com/exploits/52333"}, {"name": "AirKeyboard Homepage", "tags": ["vendor-advisory", "product"], "url": "https://airkeyboardapp.com"}, {"name": "Apple App Store Link", "tags": ["product"], "url": "https://apps.apple.com/us/app/air-keyboard/id6463187929"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/airkeyboard-ios-app-105-remote-input-injection"}], "source": {"discovery": "UNKNOWN"}, "title": "AirKeyboard iOS App 1.0.5 - Remote Input Injection", "x_generator": {"engine": "vulncheck"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control."}], "id": "CVE-2025-66555", "lastModified": "2025-12-04T21:16:09.573", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2025-12-04T21:16:09.573", "references": [{"source": "disclosure@vulncheck.com", "url": "https://airkeyboardapp.com"}, {"source": "disclosure@vulncheck.com", "url": "https://apps.apple.com/us/app/air-keyboard/id6463187929"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/52333"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/airkeyboard-ios-app-105-remote-input-injection"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}