CVE-2006-2206: Ultravnc

High severity, CVSS 10.0. EPSS: 2.1% chance of exploitation in the next 30 days.

The MS-Logon authentication scheme in UltraVNC (aka Ultr@VNC) 1.0.1 uses weak encryption (XOR) for challenge/response, which allows remote attackers to gain privileges by sniffing and decrypting passwords.

Affected products

• Ultravnc Ultravnc: version 1.0.1 only

Published 2006-05-05. Last modified 2026-06-16.