CVE-2002-0971

MEDIUM 4.6CVE-2002-0971 · Published 24/09/2002 · updated 16/06/2026

In short

CVE-2002-0971 is a MEDIUM (CVSS 4.6) vulnerability affecting winvnc server (att), tightvnc (tightvnc), tridiavnc (tridia).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 33.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
winvnc server att	`= 3.3.3_r7≤ 3.3.3_r9`	No fix yet
tightvnc tightvnc	`= 1.2.0= 1.2.1= 1.2.5`	No fix yet
tridiavnc tridia	`= 1.5= 1.5.1= 1.5.2= 1.5.4`	No fix yet

Description

Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box.

References

marc.info
iss.net/security_center/static/9979.php
securityfocus.com/bid/5530

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free