Vulnerability · Published Apr 18, 2022 · Assigned by Fluid Attacks
CVE-2022-25226
Critical 10.0
In plain English
A critical-severity security flaw in ThinVNC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.0% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS NVD)10.0Critical
Exploit odds (30 days)11.0%top 4.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC
Official description
ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the server.
Affected products (as reported)
References
- https://fluidattacks.com/advisories/sinatra/ x_refsource_MISC