← Vulnerability feed

Vulnerability record · CVE-2001-1422 · published 23 January 2001

CVE-2001-1422: Att winvnc vulnerability

Att · Winvnc

WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.

7.5 CVSS 2.0 High EPSS 2.1% · top 19.4%
7.5CVSS 2.0 base score
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
16 Jun 2026Last modified by NVD

Description

WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.kb.cert.org/vuls/id/303080 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/2275 Vendor Advisory
http://www1.corest.com/common/showdoc.php?idxseccion=10&idx=117 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/5992
http://www.kb.cert.org/vuls/id/303080 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/2275 Vendor Advisory
http://www1.corest.com/common/showdoc.php?idxseccion=10&idx=117 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/5992

Track CVE-2001-1422 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2001-0168AT&T WinVNC server buffer overflow via long HTTP GET requestAT&T WinVNC server 3.3.3r7 and earlier contains a buffer overflow that is triggered by a long HTTP GET request when the DebugLevel registry key is gr…EPSS 71%analysed9.0CVE-2000-1164Att winvnc vulnerabilityWinVNC installs the WinVNC3 registry key with permissions that give Special Access (read and modify) to the Everybody group, which allows users to re…EPSS 1.5%7.6CVE-2001-0167AT&T WinVNC client buffer overflow via rfbConnFailed reason stringAT&T WinVNC client 3.3.3r7 and earlier contains a buffer overflow in its handling of the rfbConnFailed packet, triggered by an overly long reason str…EPSS 51%analysed

Source: NIST National Vulnerability Database (record CVE-2001-1422), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.