UltraVNC through version 1.8.2.2 employs an insecure Diffie-Hellman key exchange in its MS-Logon II authentication scheme, using a 64-bit prime size controlled by DH_MAX_BITS, which is vulnerable to rapid discrete logarithm attacks such as Pollard's rho. Additionally, the private exponent is generated using a weak RNG seeded by time(NULL) and based on libc rand(), resulting in only about 31 bits of entropy. These factors enable a passive network attacker who observes the handshake to recover the shared DH key and decrypt the encapsulated username and password, leading to full credential disclosure. The vulnerability is limited to legacy MS-Logon II connections; MS-Logon III, which uses X25519 and AES-256-GCM, is not affected. No vendor advisory or patch information is available at this time.

An attacker capable of passively observing the MS-Logon II handshake can derive the shared Diffie-Hellman key and decrypt sensitive authentication credentials (username and password). This results in full credential disclosure without requiring active interaction or elevated privileges. The confidentiality and integrity of the authentication process are compromised. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the legacy MS-Logon II authentication scheme in UltraVNC. Prefer MS-Logon III authentication, which uses stronger cryptographic algorithms (X25519 and AES-256-GCM) and is not affected by this vulnerability.