Is port 5900 (VNC) exposed to the internet, and how strong is its password really?

Why VNC’s password security is weaker than it looks

VNC is built on RFB, the Remote Framebuffer Protocol (RFC 6143), and its original “VNC Authentication” security type truncates the user’s password to 8 characters (padding shorter ones with nulls) and uses it as a DES encryption key for a challenge-response exchange. The RFC itself says plainly that “this type of authentication is known to be cryptographically weak and is not intended for use on untrusted networks” — exactly the situation a VNC server forwarded directly to the internet is in. Many VNC server implementations still default to this scheme or offer it as an option.

Why this matters for ransomware risk specifically

The same joint CISA & FBI advisory (AA22-137A) that names RDP a top initial-access vector for ransomware covers remote-access services generally, and VNC shares the core problem: once port 5900 is reachable from the internet, an attacker can run automated credential attacks against it, and if VNC Authentication’s 8-character/DES limitation is in play, those attacks have an easier target than a modern authentication scheme would present.

How to check your own exposure

AdminKit’s planned open ports check is designed to test whether port 5900 on your own public IP responds from outside your network. Confirm your current public IP with what is my IP first.

How to fix it

• Don’t forward port 5900 to the internet directly — put VNC access behind a VPN or zero-trust tunnel, the same recommendation as for RDP.
• If your VNC server supports it, use a stronger authentication scheme than classic VNC Authentication; several modern VNC implementations support TLS-based or SSH-tunneled connections instead.
• Use a long, unique password regardless — the 8-character DES limitation is a reason to add a tunnel, not a reason a weaker password is “good enough” without one.

See RDP and VNC exposed to the internet for the shared zero-trust alternative and more on why both protocols end up targeted the same way.

Defensive use only

Every check this page links to is for assets you own or are explicitly authorized to test. Never scan, probe, or attempt to connect to a network or device you don’t control — AdminKit’s active checks only ever run against the IP making the request or an asset you’ve verified ownership of. See our Disclaimer and Acceptable Use Policy for the full terms.