Based on data from shodan.io, over 600,000 VNC servers are available online.

The exact number of installations is hard to estimate. VNC has become one of the most widespread systems of its kind, thanks in part to cross-platform implementations and open-source licenses. There are implementations both for common operating systems – GNU/Linux, Windows, Android – and for exotic ones. It is worth noting that the protocol’s specification does not limit the choice of OS and allows cross-platform implementations. The VNC system is designed to provide one device with remote access to another device’s screen. Some of the vulnerabilities identified, if exploited, could lead to remote code execution. As a result of this research, we identified a number of memory corruption vulnerabilities, which have been assigned a total of 37 CVE identifiers.

In this article, we discuss the findings of research which covered several different implementations of a remote access system called Virtual Network Computing (VNC).

Download tightvnc security