PT-2021-23282 · Realvnc · Realvnc Viewer

Totaam · Published 2021-09-17 · Updated 2024-08-04 · CVE-2021-41380

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RealVNC Viewer version 6.21.406

Description The issue allows remote VNC servers to cause a denial of service, resulting in the application crashing via crafted RFB protocol data. It is noted that this issue requires social engineering to trick a user into connecting to a fake VNC Server, which will then cause the VNC Viewer application to hang until it is terminated. No memory leak occurs, and the resources are freed once the hung process is terminated. The resource usage remains constant during the hang, and only the process connected to the fake Server is affected.

Recommendations For RealVNC Viewer version 6.21.406, consider avoiding connections to untrusted or unknown VNC servers to minimize the risk of exploitation, as the issue is asserted to require social engineering to connect to a fake VNC Server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-41380

Affected Products

Realvnc Viewer

References · 7

• 🔥 https://gist.github.com/totaam/a90f2bb40f5b693ccec0ae903d021b03 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41380 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41380 · Vendor Advisory
• https://t.me/cvenotify/21405 · Telegram Post
• https://t.me/cvenotify/21587 · Telegram Post
• https://t.me/cibsecurity/29072 · Telegram Post
• https://t.me/cvenotify/88897 · Telegram Post