What’s Vulnerable › Vulnerabilities

CVE-2019-17662

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 96.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-10-16 · updated 2026-06-17
• Weakness: CWE-22

Description

ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.

Affected products

• ThinVNC: 1.0-b1

References

• http://packetstormsecurity.com/files/154896/ThinVNC-1.0b1-Authentication-Bypass.html
• https://github.com/bewest/thinvnc/issues/5
• https://github.com/shashankmangal2/Exploits/blob/master/ThinVNC-RemoteAccess/POC.py
• https://redteamzone.com/ThinVNC/
• http://packetstormsecurity.com/files/154896/ThinVNC-1.0b1-Authentication-Bypass.html
• https://github.com/bewest/thinvnc/issues/5
• https://github.com/shashankmangal2/Exploits/blob/master/ThinVNC-RemoteAccess/POC.py
• https://redteamzone.com/ThinVNC/

Get alerted when CVE-2019-17662 or the next vulnerability affects your stack