UltraVNC Repeater EUVD-2026-40885

The repeater must be running its HTTP web administration server (default TCP 80) and be reachable over the network by the attacker, and the installation must still use the first-run default password 'adminadmi2' - i.e. a fresh or unmodified install where settings2.txt was absent at startup and the admin credential was never manually changed. What limits exploitation: if the operator has set a custom admin password, or if the admin HTTP port is firewalled/bound to a management-only interface, or if the web GUI component is disabled, the default-credential path is not usable. No user interaction and no prior authentication are required against a default configuration.

Signals are largely consistent toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) describes trivially remote, unauthenticated, low-complexity administrative access, and hardcoded-credential bugs are among the easiest to weaponize because no exploit tooling is needed - the attacker simply types 'adminadmi2'. Tempering factors: no EPSS score, KEV listing, or POC was supplied, so there is currently no confirmed active or automated exploitation, and real exposure depends on how many repeaters expose the HTTP admin port to untrusted networks (many are deployed internally or behind firewalls). The CVSS assigns A:N, which is defensible for the confidentiality/integrity read, but note that administrative control over allow/deny rules and session routing could in practice degrade availability of the relay - a limitation worth verifying against the vendor's own scoring. Net: treat as a real, near-turnkey priority wherever the admin interface is network-reachable, while recognizing exploitation likelihood scales directly with internet/LAN exposure rather than any published campaign.

An attacker scans for repeater HTTP admin ports exposed on the internet or an internal network, opens the interface, and authenticates with the documented default 'adminadmi2' since the operator never changed it. With administrator access they rewrite allow/deny rules to route or observe VNC sessions, pivoting toward the remote-desktop endpoints the repeater brokers. Given AV:N/AC:L/PR:N/UI:N this requires only network reachability and no special tooling, though no public POC beyond the disclosed credential was reported.