TightVNC Viewer flaw allows pre-authentication code execution on Windows, PoC published
VULNERABILITYredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A flaw in the TightVNC Viewer, a tool for controlling another computer's screen, could let an attacker run their own code on a Windows PC before any password is requested. The risk applies when the viewer accepts connections from the network or connects to a malicious server. Researchers have published proof-of-concept exploit code, and updating the viewer is the fix.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Update TightVNC Viewer to version 2.8.90, the recommended version for that branch, or at least 2.8.89.
- Turn off Listening Mode in the viewer when it is not needed.
- Restrict access to TCP port 5500 to trusted systems only.
- Avoid connecting the viewer to untrusted VNC servers.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News