Multiple unpatched vulnerabilities have been discovered in three Android apps that allow a smartphone to be used as a remote keyboard and mouse.

The apps in question are Lazy Mouse, PC Keyboard, and Telepad, which have been cumulatively downloaded over two million times from the Google Play Store. Telepad is no longer available through the app marketplace but can be downloaded from its website.

• Lazy Mouse (com.ahmedaay.lazymouse2 and com.ahmedaay.lazymousepro)
• PC Keyboard (com.beapps.pckeyboard)
• Telepad (com.pinchtools.telepad)

While these apps function by connecting to a server on a desktop and transmitting to it the mouse and keyboard events, the Synopsys Cybersecurity Research Center (CyRC) found as many as seven flaws related to weak or missing authentication, missing authorization, and insecure communication.

The issues (from CVE-2022-45477 through CVE-2022-45483), in a nutshell, could be exploited by a malicious actor to execute arbitrary commands sans authentication or harvest sensitive information by exposing users' keystrokes in cleartext.

The Lazy Mouse server further suffers from a weak password policy and doesn't implement rate limiting, enabling remote unauthenticated attackers to trivially brute-force the PIN and execute rogue commands.

It's worth noting that none of the apps have received any updates for over two years, making it imperative that users remove the apps with immediate effect.

"These three applications are widely used but they are neither maintained nor supported, and evidently, security was not a factor when these applications were developed," Synopsys security researcher Mohammed Alshehri said.