Saturn Remote Mouse Server contains a command injection flaw that allows an attacker on the local network to send malformed UDP JSON frames to port 27000. The malformed packets contain unsanitized command data that the service passes straight to operating system execution primitives, enabling arbitrary code execution under the service account. The attack is unauthenticated and can be performed remotely over the network, potentially compromising the host and any connected resources.

The vulnerability affects the Saturn Remote Mouse Server product from Saturn Remote. No specific affected release version is supplied by the vendor, so all runs of the affected product should be considered at risk until a patched version is deployed.

The CVSS score of 8.6 indicates a high severity vulnerability. EPSS is below 1%, suggesting low overall exploitation probability, and the issue is not listed in the CISA KEV catalog. The attack vector is local network based, exploiting unauthenticated UDP traffic on port 27000; the attacker merely needs to be on the same network subnet and does not require credentials. Once executed, the attacker can run arbitrary commands with the permissions of the service account, potentially taking full control of the host.