CVE-2026-7839

UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access

Published Jul 1, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.

Analysis

Technical impact

The background firmware includes a hard‑coded administrator password initialized during the first launch of the UltraVNC Repeater when the settings file does not yet exist. This password "adminadmi2" is written to the configuration via a standard string copy operation that does not implement any rate limiting or lockout on the HTTP Basic‑auth handler. By reaching the repeater’s HTTP port (default TCP 80) a remote attacker can immediately authenticate as an administrator and fully control the repeater configuration, including session allow/deny lists and visibility into remote sessions.

Affected Systems

The vulnerable code path exists in the UltraVNC Repeater releases up to and including 1.8.2.2. Any installation that has not yet set a custom administrator password after its first start is affected. The vendor is UltraVNC (uvnc:UltraVNC).

Risk and Exploitability

The CVSS score of 9.1 reflects the high impact of this flaw, and the lack of any EPSS or KEV listing does not diminish the risk of exploitation. Because the authentication check is exposed on a public HTTP interface with no mitigations, a remote actor can trivially obtain administrative privileges by supplying the well‑known credentials. The resulting elevated privileges allow complete manipulation of the repeater, potentially affecting confidentiality, integrity, and availability of all managed sessions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

uvnc

UltraVNC

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.8.2.2

Configuration 1 [-]

cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Uvnc

Ultravnc

Version	Status	Scheme	Platform
`[0,1.8.2.2]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade UltraVNC Repeater to a version that removes the hard‑coded password or patches the authentication logic
If an upgrade is not immediately possible, log in to the web console and change the administrator password to a strong, unique value
Restrict external network access to the repeater’s HTTP administration port (e.g., firewall or network segmentation)
Monitor inbound traffic for attempts to connect to the HTTP port and for repeated authentication failures

Generated by OpenCVE AI on July 1, 2026 at 13:05 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.655% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/ultravnc/UltraVNC
https://uvnc.com/
https://www.securin.io/zero-days/cve-2026-7839-hardcoded-default-admin-password-adminadmi2-ultravnc-repeater

History

Jul 9, 2026 5:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://www.securin.io/zero-days/cve-2026-7839-hardcoded-default-admin-password-adminadmi2-ultravnc-repeater

Jul 3, 2026 2:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 1, 2026 2:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Uvnc Uvnc ultravnc
Vendors & Products		Uvnc Uvnc ultravnc

Jul 1, 2026 5:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.
Title		UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access
Weaknesses		CWE-798
References		https://github.com/ultravnc/UltraVNC https://uvnc.com/
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`