Vulnerability in Uvnc Ultravnc
CVE-2026-7839
UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.
EPSS: 0.004 (34.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Uvnc Ultravnc — versions 0
Weakness classification (CWE)
References
- 33c584b5-0579-4c06-b2a0-8d8329fcab9c (Product, vendor-advisory, Release Notes)
- 33c584b5-0579-4c06-b2a0-8d8329fcab9c (Product, product)
- 33c584b5-0579-4c06-b2a0-8d8329fcab9c
Frequently asked questions
- What is CVE-2026-7839?
- CVE-2026-7839 is a critical-severity vulnerability in Uvnc Ultravnc, classified under Use of Hard-coded Credentials. CVSS score: 9.1/10. Published 2026-07-01.
- How severe is CVE-2026-7839?
- Critical severity. CVSS v3 base score is 9.1 out of 10.