CVE-2026-7839

Publié : 1 juillet 2026

Modifié : 1 juillet 2026

Score CVSS

9.1

CRITICAL

Description détaillée

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Références et Patchs

https://github.com/ultravnc/UltraVNC https://uvnc.com/

Dernières Vulnérabilités

CVE-2026-1239

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

VOIR DÉTAILS

CVE-2026-14193

DVP80ES300T with Improper Validation of Array Index Vulnerability

VOIR DÉTAILS

CVE-2026-12579

AS228T with Authentication Bypass Vulnerability

VOIR DÉTAILS