CVE-2026-7839: UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access
UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpys(savedpassword, 64, "adminadmi2"). The HTTP Basic-auth handler widecodeauth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UltraVNC repeaterto a version that resolves this vulnerability.Patch 1.8.2.2 - Configuration
Ensure that on first run (when settings2.txt is absent), the repeater does NOT initialize the admin password to the literal string "adminadmi2"; remove the hardcoded default so admin credentials are set securely.
UltraVNC repeater webgui (repeater/webgui/settings.c) HTTP admin password default value written from settings2.txt absence = Do not write "adminadmi2" (change/remove hardcoded default) - Compensating control
Restrict network access to the repeater HTTP administration port (default TCP 80) so only trusted hosts can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7839?
CVE-2026-7839 has a critical severity rating of 9.1.
How do I fix CVE-2026-7839?
To mitigate CVE-2026-7839, change the hardcoded default admin password as soon as possible after installation.
What software is affected by CVE-2026-7839?
CVE-2026-7839 affects UltraVNC Repeater version 1.8.2.2 and earlier.
What is the risk associated with CVE-2026-7839?
CVE-2026-7839 poses a risk of unauthorized access, as it allows unauthenticated users to access the admin panel.
When was CVE-2026-7839 published?
CVE-2026-7839 was published on July 1, 2026.