UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NUvnc Ultravnc
APPUvnc≤ 1.8.2.2
Powiązane podatności
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of Clie...
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usag...
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside Ultra2 decoder, which can p...
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETP...
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handle...