UltraVNC through version 1.8.2.2 implements the MS-Logon II authentication scheme using a Diffie-Hellman key exchange with parameters limited to 64 bits, controlled by DH_MAX_BITS. Such a small key size is vulnerable to rapid discrete logarithm attacks like Pollard's rho algorithm, enabling key recovery in under a second on modern hardware. Additionally, the private exponent is generated using a weak random number generator seeded by time(NULL) and based on libc rand(), resulting in approximately 31 bits of entropy. This makes the private exponent recoverable within a minute by a passive attacker. Consequently, an attacker who can sniff or intercept the MS-Logon II handshake can derive the shared DH key and decrypt the encapsulated username and password, leading to full credential disclosure. The vulnerability affects only the legacy MS-Logon II scheme; the newer MS-Logon III scheme using X25519 and AES-256-GCM is not impacted. No official remediation or patch information is provided.

An attacker capable of passively observing the MS-Logon II handshake can recover the shared Diffie-Hellman key due to weak cryptographic parameters and poor random number generation. This enables decryption of usernames and passwords transmitted during authentication, resulting in full credential disclosure. The vulnerability does not affect availability or integrity but compromises confidentiality of credentials. MS-Logon III connections remain secure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the legacy MS-Logon II authentication scheme in UltraVNC and prefer MS-Logon III, which uses stronger cryptography (X25519 and AES-256-GCM). Network defenders should consider disabling or restricting MS-Logon II usage to mitigate credential exposure risk.