CVE-2022-25226

CRITICAL NUCLEI

ThinVNC 1.0b1 - Auth Bypass

Title source: llm

Description

ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the server.

Exploits (1)

nomisec WORKING POC 1 stars
by krill-x7 · poc
https://github.com/krill-x7/CVE-2022-25226

Nuclei Templates (1)

ThinVNC - Authentication Bypass
CRITICALVERIFIEDby ritikchaddha
Shodan: http.favicon.hash:-1414548363
FOFA: icon_hash="571240285"

References (1)

Scores

CVSS v3 10.0
EPSS 0.8189
EPSS Percentile 99.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

Status published
Products (1)
cybelsoft/thinvnc 1.0 b1
Published Apr 18, 2022
Tracked Since Feb 18, 2026