UltraVNC repeater up to version 1.8.2.2 initializes its HTTP administration server with a hardcoded default password "adminadmi2" if the settings file settings2.txt is missing on first run. The authentication mechanism uses HTTP Basic-auth without rate limiting or lockout, allowing any remote attacker who can access the repeater's HTTP port (default TCP 80) to authenticate as administrator. This grants full control over repeater configuration, including allow/deny rules and session visibility. No vendor advisory or patch information is provided, and the vulnerability is publicly documented with a CVSS 3.1 score of 9.1 (critical).

An unauthenticated remote attacker can gain administrative access to the UltraVNC repeater by using the hardcoded default password. This access allows the attacker to modify repeater configuration, control allow/deny rules, and view session information. The vulnerability does not affect availability but compromises confidentiality and integrity at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict network access to the repeater's HTTP administration port (default TCP 80) to trusted hosts only and ensure the settings2.txt file is properly configured to avoid default password usage.