OPEN VNC SERVICES EXPOSED TO THE INTERNET

Advisory ID:   ngCERT-2026-0900020

SUMMARY

ngCERT has identified instances of Open VNC (Virtual Network Computing) services that may expose systems to unauthorised remote access due to inadequate security controls. This exposure presents a significant security risk, as successful unauthorised access could compromise sensitive information, enable credential theft, deploy malware, take over systems, and enable further attacks against connected systems. CVE-2025-27459 highlights the security risks associated with inadequate VNC credential protection. Organisations are advised to disable unnecessary VNC services and restrict required access to trusted networks through firewalls or secure VPN connections.

DESCRIPTION

Open VNC refers to VNC services that are accessible from the internet or other untrusted networks without sufficient access restrictions. VNC provides remote graphical access to systems, allowing connected users to interact with desktops, access files, execute applications and modify system settings. When improperly exposed, attackers can discover VNC services through automated scanning and attempt unauthorised access using weak, default or compromised credentials. Common VNC services may be exposed through ports such as TCP/5900, 5901 and 5902. Inadequate firewall configurations, weak authentication, unnecessary internet exposure and outdated VNC implementations can increase the risk of compromise. As a related case, CVE-2025-27459 affects a VNC application that stores passwords in the Windows Registry using DES encryption; because DES is considered broken, the original passwords can be recovered by an attacker with the required local access. The case highlights the importance of protecting VNC credentials and restricting VNC services to authorised users and trusted networks.

Damage:      Critical 

Probability:  High

Platform(s):  Windows, Linux, macOS, Servers, IoT and OT/ICS System

CONSEQUENCES

Successful exploitation of Open VNC services can lead to:

    1. Unauthorised Access.
    2. Data Theft.

    3. Credential Compromise.

    4. Malware Deployment.

    5. Lateral Movement.

    6. Session Interception.

    7. Service Disruption.

SOLUTION/MITIGATION

ngCERT recommends the following actions:

    1. Disable VNC services that are not required and remove unnecessary Internet-facing exposure.

    2. Restrict VNC access to authorised users and trusted networks using firewalls and security groups, particularly for TCP ports 5900, 5901 and 5902.

    3. Use secure VPN connections or remote-access gateways where remote VNC access is required.

    4. Enforce strong, unique credentials and enable multi-factor authentication (MFA) where supported.

    5. Enable TLS or other strong encryption and replace legacy VNC implementations that lack adequate security protections.

    6. Regularly patch and update VNC software, operating systems and related components to address known vulnerabilities.

    7. Monitor VNC activity, review authentication logs and conduct periodic vulnerability assessments to identify and respond to suspicious or unauthorised access.

HYPERLINK