Vulnerability Details : CVE-2006-2369

Public exploit exists!
RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.
Published 2006-05-15 16:06:00
Updated 2022-05-13 18:15:08
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: BypassGain privilege

Products affected by CVE-2006-2369

Exploit prediction scoring system (EPSS) score for CVE-2006-2369

EPSS FAQ
97.14%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2006-2369

  • RealVNC NULL Authentication Mode Bypass
    Disclosure Date: 2006-05-15
    First seen: 2020-04-26
    auxiliary/admin/vnc/realvnc_41_bypass
    This module exploits an Authentication bypass Vulnerability in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy listener on LPORT and proxies to the target server The AUTOVNC option requires that vncviewer be installed on the attacking machine.
  • VNC Authentication None Detection
    First seen: 2020-04-26
    auxiliary/scanner/vnc/vnc_none_auth
    Detect VNC servers that support the "None" authentication method. Authors: - Matteo Cantoni <goony@nothink.org> - jduck <jduck@metasploit.com>

CVSS scores for CVE-2006-2369

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST

CWE ids for CVE-2006-2369

  • When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
    Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2006-2369

  • Red Hat 2006-08-16
    This issue only affected version 4.1.1 and not the versions distributed with Red Hat Enterprise Linux 2.1, 3, or 4.

References for CVE-2006-2369

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close