ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via http://thin-vnc:8080/cmd?cmd=connect by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the server.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Thinvnc | Cybelsoft | 1.0-b1 (including) | 1.0-b1 (including) |