CVE-2026-7839

On first run, when the settings2.txt file does not exist, the repeater saves the administrator password as the literal string 'adminadmi2' using the strcpy_s() function in the file repeater/webgui/settings.c (line 197). The HTTP Basic-Auth handling procedure wi_decode_auth() verifies this password without any mechanism to limit login attempts or lock the account. Any attacker who can establish a connection to the repeater's HTTP port (default TCP 80) can log in as an administrator using these widely known credentials on a fresh or unmodified installation.

An attacker gains full control over the repeater configuration, including the ability to modify access allow and deny rules and to gain insight into active VNC sessions. This results in a breach of confidentiality and integrity of the entire system managed by the repeater.

Patches available from the vendor should be applied in accordance with the references. Until the update is deployed, it is recommended to immediately change the default administrator password in the repeater's HTTP interface, restrict access to the administrative port (TCP 80) to trusted IP addresses only using a firewall, and avoid exposing the repeater's HTTP port on public networks.

UltraVNC Repeater versions up to and including 1.8.2.2, on fresh or unmodified installations (without manually set administrator password).