CVE-2026-7839: UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access

Synopsis

A hardcoded default admin password vulnerability exists in UltraVNC repeater through version 1.8.2.2. The repeater writes the literal string "adminadmi2" as the HTTP administration password on first run, with no rate-limiting or lockout on the Basic-auth handler, meaning any attacker who can reach TCP port 80 needs no credentials beyond this publicly known default. Successful exploitation gives the attacker full administrative control over repeater configuration, including access control rules and active session visibility. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the repeater's HTTP administration port (default TCP 80) over the network; any system with network connectivity to that port is exposed.

• AuthenticationNot required

  No credential discovery is needed because the hardcoded default password "adminadmi2" is publicly documented in the CVE record, making authentication effectively absent on unmodified installations.

• Victim interactionNot required

  No victim action is required; the attacker sends HTTP requests directly to the repeater without any user involvement.

• Attack complexityDetail

  Exploit complexity is low; the attack requires no special conditions, race windows, or environmental factors beyond network access to the HTTP port.

Blast Radius

• Attacker reads the full repeater configuration, including allow/deny rules and active session metadata, exposing which VNC clients and servers are connected and their addressing.
• Attacker modifies access control rules to permit or block arbitrary VNC sessions, enabling unauthorized remote desktop access to systems relaying through the repeater.
• Attacker reconfigures the repeater to redirect or intercept VNC sessions, positioning themselves for on-path inspection of VNC traffic.