Hardcoded Admin Password in UltraVNC Repeater

Executive Summary

This vulnerability exists in UltraVNC repeater versions up to 1.8.2.2, where the HTTP administration server is initialized with a hardcoded default password. Specifically, if the settings file (settings2.txt) is missing on the first run, the repeater sets the admin password to the literal string "adminadmi2". The HTTP Basic-auth handler verifies this password without any rate-limiting or lockout mechanisms. As a result, any remote attacker who can access the repeater's HTTP port (default TCP 80) can authenticate as an administrator using this known default password.

This allows the attacker to gain full control over the repeater configuration, including the ability to modify allow/deny rules and view session information.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have a severe impact as it allows an unauthenticated remote attacker to gain administrative access to the UltraVNC repeater. This means the attacker can fully control the repeater's configuration, potentially altering access controls and monitoring sessions.

Such unauthorized access can lead to unauthorized data exposure, manipulation of network traffic, and disruption of services relying on the repeater.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the UltraVNC repeater HTTP administration server is running with the default hardcoded password "adminadmi2" on the HTTP port (default TCP 80). Since the repeater uses HTTP Basic authentication without rate-limiting or lockout, an attacker can authenticate remotely using this default credential.

To detect this on your system or network, you can attempt to authenticate to the UltraVNC repeater HTTP administration interface using the default credentials.

• Use a command-line HTTP client like curl to test authentication: curl -v --user admin:adminadmi2 http://<repeater-ip>/
• Scan your network for hosts with TCP port 80 open that respond as UltraVNC repeater HTTP servers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include changing the default hardcoded password on the UltraVNC repeater HTTP administration server to a strong, unique password as soon as possible.

Additionally, restrict access to the repeater HTTP port (default TCP 80) by using firewall rules or network segmentation to limit exposure to trusted hosts only.

Ensure that the settings2.txt file is created with a secure password to prevent the repeater from using the default password on startup.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any remote attacker to gain full administrative control over the UltraVNC repeater configuration by exploiting a hardcoded default password without any rate-limiting or lockout mechanisms.

Such unauthorized access could lead to exposure or manipulation of sensitive data and configurations, potentially violating data protection requirements under standards like GDPR and HIPAA.

Specifically, the lack of proper authentication controls and the possibility of unauthorized administrative access may result in non-compliance with security controls mandated by these regulations, which require protection of personal and health information against unauthorized access.

Useful 0 Not Useful 0