CVE-2026-7839
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
UltraVNC repeater up to version 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. On first run, when settings2.txt is absent, it writes the literal string "adminadmi2" as the admin password. The HTTP Basic-auth handler checks this password without rate-limiting or lockout.
Risk Assessment
Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.
Recommendation
Immediately change the default admin password after the first run and consider restricting access to the HTTP port to trusted IP addresses or implementing additional authentication.
Other vulnerabilities in UltraVNC repeater
See all- CVE-2016-5673High
UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, allowing remote attackers to obtain open-proxy functionality by using a :: substring between the IP address and port number.
- CVE-2026-7840Critical
UltraVNC repeater through version 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an unauthenticated attacker who can reach the repeater HTTP port (default TCP 80) can overflow hdrbuf by at least 500 bytes with a single HTTP request containing a URI of 1500 bytes or longer, corrupting adjacent .bss-segment globals.
- CVE-2026-7829High
In UltraVNC repeater up to version 1.8.2.2, a post-authentication out-of-bounds write vulnerability exists. In the allow/deny rule parser, after copying a token into a fixed-size buffer, the code unconditionally writes a NUL terminator at position len without checking if it exceeds the buffer size. An authenticated administrator can save a rule with a token length equal to or greater than the buffer size, overwriting adjacent stack data.
- CVE-2026-44042Low
UltraVNC repeater up to version 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. The wi_uudecode() function in webutils.c:817 uses a strict greater-than comparison (>) instead of greater-than-or-equal (>=), leaving a latent vulnerability. Currently, the risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer.
Original NVD description (English source)
UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS