The background firmware includes a hard‑coded administrator password initialized during the first launch of the UltraVNC Repeater when the settings file does not yet exist. This password "adminadmi2" is written to the configuration via a standard string copy operation that does not implement any rate limiting or lockout on the HTTP Basic‑auth handler. By reaching the repeater’s HTTP port (default TCP 80) a remote attacker can immediately authenticate as an administrator and fully control the repeater configuration, including session allow/deny lists and visibility into remote sessions.

The vulnerable code path exists in the UltraVNC Repeater releases up to and including 1.8.2.2. Any installation that has not yet set a custom administrator password after its first start is affected. The vendor is UltraVNC (uvnc:UltraVNC).

The CVSS score of 9.1 reflects the high impact of this flaw, and the lack of any EPSS or KEV listing does not diminish the risk of exploitation. Because the authentication check is exposed on a public HTTP interface with no mitigations, a remote actor can trivially obtain administrative privileges by supplying the well‑known credentials. The resulting elevated privileges allow complete manipulation of the repeater, potentially affecting confidentiality, integrity, and availability of all managed sessions.