What is the CVSS score of EUVD-2026-40885?

EUVD-2026-40885 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of UltraVNC Repeater are affected by EUVD-2026-40885?

UltraVNC repeater installations (versions 1.8.2.2 and earlier) are vulnerable to unauthorized remote administrative access through well-known default credentials, compromising the integrity and…

How to fix or mitigate EUVD-2026-40885?

Within 24 hours: Inventory all systems running UltraVNC repeater through version 1.8.2.2; assess network exposure of HTTP administration port (TCP 80). Within 7 days: Deploy firewall rules restricting TCP 80 access to trusted administrative networks only; disable HTTP administration interface if alternative management methods exist; enable authentication logging and monitoring. Within 30 days: Evaluate alternative remote access solutions; develop upgrade plan contingent on vendor patch availability; document all compensating controls and remaining risk acceptance.

UltraVNC Repeater EUVD-2026-40885

| CVE-2026-7839 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-07-01 securin

GHSA-h7cc-6wq3-9h7x

Authentication Bypass Ultravnc

9.1

CVSS 3.1 · Vendor: securin

Severity by source

Vendor (securin) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote, unauthenticated, single well-known credential and no lockout give AV:N/AC:L/PR:N/UI:N; admin control over config yields C:H/I:H, with A:N kept per the described impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (securin).

CVSS VectorVendor: securin

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:20 vuln.today

DescriptionCVE.org

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.

AnalysisAI

Authentication via hardcoded default credentials in UltraVNC repeater through 1.8.2.2 lets any remote attacker who can reach the HTTP administration port (default TCP 80) log in as administrator. On a fresh or unmodified install where settings2.txt is absent, the repeater writes the literal password 'adminadmi2', and the Basic-auth handler enforces no rate-limiting or lockout, so a single well-known credential yields full control over allow/deny rules and session visibility. Rated CVSS 9.1 (CWE-798); no public exploit identified at time of analysis, though the credential itself is disclosed in the advisory.

Technical ContextAI

UltraVNC repeater is a relay/proxy service that brokers VNC sessions between viewers and servers across NAT/firewall boundaries, commonly used for remote support. The flaw lives in its bundled HTTP web administration GUI (repeater/webgui/settings.c). CWE-798 (Use of Hard-coded Credentials) is the root-cause class: at settings.c:197 the first-run initialization path calls strcpy_s(saved_password, 64, "adminadmi2") when the persisted config file settings2.txt does not exist, baking a fixed secret into the trust boundary. The HTTP Basic-auth verifier wi_decode_auth() then compares submitted credentials against this static value with no brute-force protection, so the 'secret' is effectively public and identical across every default deployment. The single affected component per CPE is cpe:2.3:a:uvnc:ultravnc.

RemediationAI

No vendor-released fixed version was identified in the provided data, so treat patch availability as unconfirmed and monitor https://uvnc.com/ and https://github.com/ultravnc/UltraVNC for an update. The immediate and decisive mitigation is operator-driven: log into the repeater web admin and change the administrator password away from 'adminadmi2' (this removes the hardcoded credential exposure entirely and has no functional side effect), and confirm settings2.txt exists and is persisted so the default is not re-applied on restart. Restrict reachability of the HTTP admin port (default TCP 80) with host or network firewall rules - bind it to localhost or a management VLAN, or place it behind a VPN - accepting the trade-off that legitimate remote administration must then traverse that control. If the web GUI is not needed, disable the HTTP administration server to eliminate the attack surface, at the cost of losing browser-based configuration. Rotate credentials and review the repeater's allow/deny rules for tampering afterward.