CVE-2001-1422
7.5 · HIGHWinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
Overview
CVE-2001-1422 is a high-severity vulnerability affecting att winvnc. It was published on January 23, 2001 and has a CVSS 2.0 base score of 7.5 (HIGH).
This vulnerability has a CVSS 2.0 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical description
WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
Remediation
Check the references section for vendor advisories and patches from att. Update winvnc to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|---|---|---|
| att | winvnc | 0 | Affected |
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2001-1422?
CVE-2001-1422 is a high-severity vulnerability affecting att winvnc. It was published on January 23, 2001 and has a CVSS 2.0 base score of 7.5 (HIGH).
How severe is CVE-2001-1422?
This vulnerability has a CVSS 2.0 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2001-1422?
Check the references section for vendor advisories and patches from att. Update winvnc to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2001-1422?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2001-1422 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related HIGH CVEs from 2001
View all- 10.0CVE-2000-1089
Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands, ak
View details - 10.0CVE-2000-1126
Vulnerability in auto_parms and set_parms in HP-UX 11.00 and earlier allows remote attackers to exec
View details - 10.0CVE-2000-1157
Buffer overflow in NAI Sniffer Agent allows remote attackers to execute arbitrary commands via a lon
View details - 10.0CVE-2000-1172
Buffer overflow in Gaim 0.10.3 and earlier using the OSCAR protocol allows remote attackers to condu
View details - 10.0CVE-2000-0894
HTTP server on the WatchGuard SOHO firewall does not properly restrict access to administrative func
View details - 10.0CVE-2000-0895
Buffer overflow in HTTP server on the WatchGuard SOHO firewall allows remote attackers to cause a de
View details - 10.0CVE-2001-0008
Backdoor account in Interbase database server allows remote attackers to overwrite arbitrary files u
View details - 10.0CVE-2001-0010
Buffer overflow in transaction signature (TSIG) handling code in BIND 8 allows remote attackers to g
View details - 10.0CVE-2001-0011
Buffer overflow in nslookupComplain function in BIND 4 allows remote attackers to gain root privileg
View details - 10.0CVE-2001-0013
Format string vulnerability in nslookupComplain function in BIND 4 allows remote attackers to gain r
View details - 10.0CVE-2001-0022
simplestguest.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands v
View details - 10.0CVE-2001-0023
everythingform.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands
View details