What this actually is.
Technical background, root cause, and affected surface.
Global buffer hdrbuf[1000] in repeater/webgui/webutils.c is filled by unchecked sprintf in wi_senderr() and wi_replyhdr(). HTTP receive buffer accepts URIs up to ~150 KB. A URI ≥1001 bytes overflows hdrbuf, corrupting adjacent .bss globals including function pointers. No authentication required.
- Vendor
- UltraVNC
- Product
- UltraVNC Repeater
- Severity
- Critical
- CVSS Score
- 9.8
- Status
- Fixed
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-787: Out-of-bounds Write
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
poc_finding005_repeater_overflow_vendor.py: GET /[1500xA] HTTP/1.0 → 404 → wi_senderr writes URI into hdrbuf[1000]. Crash-trigger only; no shellcode.
The bug, and the fix.
char hdrbuf[HDRBUFSIZE]; // global 1000 bytes (webio.h:181) char *cp = hdrbuf + strlen(hdrbuf); sprintf(cp, "WWW-Authenticate: Basic realm=\"%s\"", sess->ws_uri); // attacker URI cp += strlen(cp); sprintf(cp, "File: %s<br>", sess->ws_uri); // second overflow
Root cause: sprintf used instead of snprintf for attacker-controlled URI into a fixed 1000-byte global buffer shared across threads. No URI length validation before response construction.
When does this fire?
All conditions must be true for the exploit to succeed.
Attacker reaches repeater HTTP port (default TCP 80). 2. Sends HTTP request with URI ≥1001 bytes (any method). 3. Server generates 4xx/2xx response. 4. wi_senderr/wi_replyhdr writes full URI into hdrbuf[1000] without length check.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
RCE as the repeater process user. All relayed VNC sessions exposed. Complete host compromise of the relay node.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Replace sprintf with snprintf using remaining buffer space as limit. Allocate response buffer per-session. Vendor fix: sprintf → snprintf with HDR_REMAINING bounds; wi_sanitize_uri() added before embedding URI.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.