What this actually is.
Technical background, root cause, and affected surface.
UltraVNC repeater writes strcpy_s(saved_password, 64, "adminadmi2") in settings.c:197 on every first run. The HTTP Basic-auth handler wi_decode_auth() checks against this value with no rate-limiting or lockout. The credential is documented in the official vendor PDF, making it publicly known.
- Vendor
- UltraVNC
- Product
- UltraVNC Repeater
- Severity
- Critical
- CVSS Score
- 9.1
- Status
- Fixed
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CWE
- CWE-798: Use of Hard-coded Credentials
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
HTTP GET /index.html with Authorization: Basic YWRtaW46YWRtaW5hZG1pMg== (admin:adminadmi2) returns HTTP 200 on fresh UltraVNC repeater install. Live-confirmed.
The bug, and the fix.
strcpy_s(saved_password, 64, "adminadmi2"); // settings.c:197 — first-run default // wi_decode_auth() compares HTTP Basic credentials against saved_password with no rate limit or lockout
Root cause: Hardcoded credential written unconditionally on first run. No forced password change mechanism, no randomisation, no rate limiting on the auth endpoint.
When does this fire?
All conditions must be true for the exploit to succeed.
UltraVNC repeater installed with default config (settings2.txt absent or unmodified). 2. Attacker reaches HTTP admin port (default TCP 80). 3. Sends HTTP Basic auth with admin:adminadmi2. 4. Full admin access granted.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Full administrative access to the repeater: allow/deny rules, session logs, configuration. Chains with CVE-2026-7829 for code execution on the repeater host.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Generate a cryptographically random per-install password on first start using CryptGenRandom. Display to operator once. Add rate-limiting to wi_decode_auth. Vendor fix applied.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.