CVE-2025-66576 is an OS command injection vulnerability in Remote Keyboard Desktop 1.0.1. The flaw arises from improper neutralization of special elements in input passed to the rundll32.exe exported function, enabling remote attackers to execute arbitrary system commands without authentication. The vulnerability has a CVSS 4.0 base score of 8.9, indicating high impact and ease of exploitation. No patch or official remediation guidance is currently provided, and the product is not a cloud service.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands on affected systems, potentially leading to full system compromise. The vulnerability does not require user interaction or privileges, increasing its risk. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Remote Keyboard Desktop service and monitor for suspicious activity related to rundll32.exe usage. Avoid exposing the vulnerable service to untrusted networks.