What this actually is.
Technical background, root cause, and affected surface.
UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.
- Vendor
- UltraVNC
- Product
- UltraVNC Repeater
- Severity
- Critical
- CVSS Score
- 9.1
- Status
- Fixed
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CWE
- CWE-798: Use of Hard-coded Credentials
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
HTTP GET /index.html with Authorization: Basic YWRtaW46YWRtaW5hZG1pMg== (admin:adminadmi2) returns HTTP 200 on fresh UltraVNC repeater install. Live-confirmed.
The bug, and the fix.
strcpy_s(saved_password, 64, "adminadmi2"); // settings.c:197 — first-run default // wi_decode_auth() compares HTTP Basic credentials against saved_password with no rate limit or lockout
Root cause: Hardcoded credential written unconditionally on first run. No forced password change mechanism, no randomisation, no rate limiting on the auth endpoint.
When does this fire?
All conditions must be true for the exploit to succeed.
UltraVNC repeater installed with default config (settings2.txt absent or unmodified). 2. Attacker reaches HTTP admin port (default TCP 80). 3. Sends HTTP Basic auth with admin:adminadmi2. 4. Full admin access granted.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Full administrative access to the repeater: allow/deny rules, session logs, configuration. Chains with CVE-2026-7829 for code execution on the repeater host.
C:H · I:H · A:N
CWE-798: Use of Hard-coded Credentials
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Generate a cryptographically random per-install password on first start using CryptGenRandom. Display to operator once. Add rate-limiting to wi_decode_auth. Vendor fix applied.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered during audit
Live-confirmed HTTP 200 with admin:adminadmi2
Reported to vendor
Fix validated
Planned public disclosure
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.