CVE-2008-4770

Estado: ModificadaAlta (10)—
The CMsgReader::readRect function in the VNC Viewer component in RealVNC VNC Free Edition 4.0 through 4.1.2, Enterprise Edition E4.0 through E4.4.2, and Personal Edition P4.0 through P4.4.2 allows remote VNC servers to execute arbitrary code via crafted RFB protocol data, related to "encoding type."
CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Puntuación base: 10
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 4.05%
Percentil entre todas las CVEs puntuadas: 90
Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Realvnc — Realvnc
CWE

CWE-20
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-4770",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-01-16T21:30:03.327",
  "references": [
    {
      "url": "http://secunia.com/advisories/32317",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/33689",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/34184",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-140455-01-1",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248526-1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200903-17.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.realvnc.com/pipermail/vnc-list/2008-November/059432.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.realvnc.com/products/free/4.1/release-notes.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.realvnc.com/products/upgrade.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2009-0261.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/31832",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/33263",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2868",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45969",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47937",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9367",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg01025.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32317",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33689",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/34184",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-140455-01-1",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248526-1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200903-17.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.realvnc.com/pipermail/vnc-list/2008-November/059432.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.realvnc.com/products/free/4.1/release-notes.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.realvnc.com/products/upgrade.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2009-0261.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/31832",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/33263",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2868",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45969",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47937",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9367",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg01025.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The CMsgReader::readRect function in the VNC Viewer component in RealVNC VNC Free Edition 4.0 through 4.1.2, Enterprise Edition E4.0 through E4.4.2, and Personal Edition P4.0 through P4.4.2 allows remote VNC servers to execute arbitrary code via crafted RFB protocol data, related to \"encoding type.\""
    },
    {
      "lang": "es",
      "value": "La función CMsgReader::readRect en el componente VNC Viewer en RealVNC VNC Free Edition v4.0 hasta v4.1.2, Enterprise Edition vE4.0 hasta vE4.4.2, y Personal Edition vP4.0 hasta vP4.4.2 permite a servidores remotos VNC ejecutar código de su elección mediante el protocolo de datos RFB manipulado, relacionado con \"tipo codificado\"."
    }
  ],
  "lastModified": "2026-06-16T22:58:30.443",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:realvnc:realvnc:4.0:*:free:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D33C48F6-27C1-4AA4-A027-71E06E31B53F"
            },
            {
              "criteria": "cpe:2.3:a:realvnc:realvnc:4.1.2:*:free:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D102EDC-3B06-4880-8A93-155562A2B209"
            },
            {
              "criteria": "cpe:2.3:a:realvnc:realvnc:4.4.2:*:enterprise:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80F206D4-09C2-478C-A429-C672B635EF10"
            },
            {
              "criteria": "cpe:2.3:a:realvnc:realvnc:e4.0:*:enterprise:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48BE82EC-F0F2-425C-A7DB-63EFF4A7702E"
            },
            {
              "criteria": "cpe:2.3:a:realvnc:realvnc:p4.0:*:personal:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2785BEA3-4A77-4204-92D1-F66140302B2E"
            },
            {
              "criteria": "cpe:2.3:a:realvnc:realvnc:p4.4.2:*:personal:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5140685C-E1CF-4B07-82DE-EAD311994E7B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}