CVE-2024-42049

CRITICAL

TightVNC Server for Windows < 2.8.84 - Unauthenticated Exposure of Sensitive Information via Control Pipe

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2024-42049. PoCs published by Ionut Zevedei, zeved.

AI-analyzed exploit summary This exploit manipulates the TightVNC control pipe to execute commands such as disconnecting clients, shutting down the server, or retrieving server configuration, including encrypted passwords which are then decrypted using a hardcoded DES key.

Description

TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.

Exploits (2)

exploitdb WORKING POC
by Ionut Zevedei · clocalmultiple
https://www.exploit-db.com/exploits/52322

This exploit manipulates the TightVNC control pipe to execute commands such as disconnecting clients, shutting down the server, or retrieving server configuration, including encrypted passwords which are then decrypted using a hardcoded DES key.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: TightVNC 2.8.83 and earlier
No auth needed
Prerequisites: Access to the named pipe (e.g., \\.\pipe\TightVNC_Service_Control)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by zeved · poc
https://github.com/zeved/CVE-2024-42049-PoC

This repository contains a functional PoC exploit for CVE-2024-42049, targeting TightVNC Server for Windows. The exploit interacts with named pipes to execute commands such as disconnecting clients, retrieving server info, and decrypting passwords from server configurations.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: TightVNC Server for Windows (versions before 2.8.84)
No auth needed
Prerequisites: Network access to the target machine · SMB access to the target machine
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.1
EPSS 0.0575
EPSS Percentile 90.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-200
Status published
Published Jul 28, 2024
Tracked Since Feb 18, 2026