CVE-2025-66555: AirKeyboard iOS Authentication Bypass Flaw

CVE-2025-66555 Overview

CVE-2025-66555 is a missing authentication vulnerability [CWE-306] in the AirKeyboard iOS application version 1.0.5. The app exposes a network service that accepts keystroke input without verifying the identity of the sender. Unauthenticated attackers on a reachable network can inject arbitrary keystrokes into the victim's iOS device in real time. No user interaction is required on the target device. The result is full remote input control, which an attacker can leverage to launch applications, open URLs, exfiltrate data, or interact with any focused input field.

Critical Impact
Remote attackers with network access to the device can type arbitrary keystrokes into an iOS device running AirKeyboard 1.0.5 without authentication or user interaction.

Affected Products

AirKeyboard iOS App version 1.0.5
Apple iOS devices running the vulnerable AirKeyboard release
Networks where the AirKeyboard listening service is reachable by untrusted hosts

Discovery Timeline

2025-12-04 - CVE-2025-66555 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-66555

Vulnerability Analysis

AirKeyboard converts an iOS device into a wireless input peripheral. The companion service on the iOS app listens on the local network and accepts keystroke messages from a paired client. In version 1.0.5, the service does not authenticate the source of these messages. Any host that can reach the listening port can send input frames that the application forwards directly into the iOS input subsystem.

Because the keystrokes arrive through a trusted input channel, they target whichever application currently holds focus on the device. An attacker can therefore drive Safari, Mail, Messages, or any other foreground app. The flaw maps to [CWE-306] Missing Authentication for Critical Function and is tracked in Exploit-DB #52333 and the VulnCheck Advisory on AirKeyboard.

Root Cause

The AirKeyboard service trusts any client that can establish a connection to its input port. It performs no pairing handshake, no shared secret check, and no cryptographic validation of the sender. Authorization to type is implicit in network reachability, which violates least-privilege design.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker on the same Wi-Fi segment, or on a routed network that can reach the iOS device, sends input messages to the AirKeyboard service. Hostile networks, shared corporate Wi-Fi, public hotspots, and conference networks all expose the device. See the VulnCheck Advisory on AirKeyboard for protocol details.

The vulnerability is described in prose only because no verified, sanitized exploit code is reproduced here. Refer to Exploit-DB #52333 for the public proof of concept.

Detection Methods for CVE-2025-66555

Indicators of Compromise

Unexpected inbound TCP or UDP connections from untrusted hosts to the AirKeyboard listening port on iOS devices.
iOS devices showing unsolicited keystrokes, app launches, URL navigations, or text appearing in input fields while idle.
Network flows to AirKeyboard endpoints originating from hosts that were never paired or authorized by the user.

Detection Strategies

Inspect wireless network traffic for connections to AirKeyboard service ports from hosts other than the legitimate desktop client.
Correlate iOS mobile device management (MDM) telemetry with network logs to identify devices running AirKeyboard 1.0.5.
Flag the presence of the AirKeyboard app on managed iOS devices via MDM application inventory queries.

Monitoring Recommendations

Monitor guest and BYOD Wi-Fi segments for peer-to-peer traffic targeting iOS devices on non-standard high ports.
Alert on repeated short-lived connections to the same iOS host, which is consistent with input injection probing.
Track Exploit-DB #52333 signatures in IDS rulesets and update detections when the upstream advisory is revised.

How to Mitigate CVE-2025-66555

Immediate Actions Required

Remove or disable the AirKeyboard iOS app on all managed devices until a fixed release is confirmed by the vendor.
Block AirKeyboard service ports at wireless controllers and segment guest networks from corporate iOS devices.
Instruct users to avoid running AirKeyboard 1.0.5 on untrusted networks such as public Wi-Fi or shared hotspots.

Patch Information

No fixed version is referenced in the NVD entry for CVE-2025-66555 at the time of publication. Consult the AirKeyboard App Overview and the Air Keyboard iOS App Page for vendor updates. Apply any newer release that explicitly addresses missing authentication on the input service.

Workarounds

Enforce client isolation on Wi-Fi access points so iOS devices cannot receive peer connections from other wireless clients.
Use a VPN or per-app firewall profile on iOS to restrict inbound connections while the app is installed.
Uninstall AirKeyboard 1.0.5 entirely on devices that handle sensitive accounts or corporate data.

bash

# Example wireless controller rule concept: drop peer-to-peer traffic on the guest SSID
# (syntax depends on the specific wireless vendor)
set wlan ssid "Guest" client-isolation enable
set firewall rule deny from wlan-guest to wlan-guest proto tcp
set firewall rule deny from wlan-guest to wlan-guest proto udp