Every CVE Search/ Get API key

CVE-2006-2369

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager,...

7.5 HighPublic exploit

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.

Exploit likelihood

92.4%Up 13.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.

Record
CVE-2006-2369
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.

Record
CVE-2006-2369
Updated
2026-11-02
EUVDEUVD-2006-2370 No score

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.

Record
EUVD-2006-2370
Updated
2026-11-03
GitHub AdvisoriesGHSA-p5jc-gpgq-6vfg No score

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager,...

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.

Record
GHSA-p5jc-gpgq-6vfg
Weakness
CWE-287
Updated
2026-11-02
OSV No score

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.

Record
CVE-2006-2369
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBRealVNC - Authentication Bypass (Metasploit)2011-08-26
Exploit-DBRealVNC 4.1.0 < 4.1.1 - VNC Null Authentication Bypass2006-05-16
Exploit-DBRealVNC 4.1.0 < 4.1.1 - VNC Null Authentication Bypass (Metasploit)2006-05-15
Exploit-DBRealVNC 4.1.0/4.1.1 - Authentication Bypass2012-05-13
MetasploitRealVNC NULL Authentication Mode Bypass2006-05-15
MetasploitVNC Authentication None Detection

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-2369 is a high vulnerability (CVSS 7.5) in Vnc Realvnc, published May 15, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 92.4%, the 99th percentile. No source names a fixed version.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open