Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Port 5900 (VNC): what it is, how it is attacked and how to secure it

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 12 November 2026.

In one sentence: Port 5900 is the door that VNC remote desktop software listens on, and if it faces the internet, anyone can try to take control of that computer’s screen, keyboard and mouse.

What runs on this port

VNC (Virtual Network Computing) lets you see and control another computer’s desktop. It uses the Remote Framebuffer (RFB) protocol, described in RFC 6143. The RFC says an RFB client contacts the server on TCP port 5900, and that on systems with several RFB servers, server N typically listens on port 5900+N. It also mentions port 5800 for a small web server that serves a browser-based viewer, and port 5500 for “reverse” connections where the server calls the viewer. The only port IANA has assigned for RFB is 5900.

It is used by IT support, on kiosks and signage, on Linux and macOS desktops, and on some industrial and building control panels.

VNC viewer(client) VNC serverTCP 5900 1. Agree protocol version 2. Server offers security type: None or password 3. Password check (8 characters), then screen and input The standard adds no encryption of its own: run it inside SSH, IPsec or a VPN

Why attackers look for it

Internet-wide scanning and search engines for devices list exposed VNC servers by port. SecurityWeek, reporting Forescout research in April 2026, says a Shodan search showed roughly 1.8 million RDP and 1.6 million VNC servers exposed to the internet. Forescout found the majority were honeypots, ISPs and hosting providers, but still linked 29,000 VNC servers to specific industries, including retail, education, services, manufacturing and healthcare.

An open VNC port is attractive because success gives instant, interactive control of a machine, with no malware needed.

How it gets attacked

  • No authentication. RFC 6143 defines a security type called “None”, where no authentication is needed. SecurityWeek reports nearly 60,000 exposed VNC servers had no authentication enabled, and 670 of them gave direct access to industrial control panels.
  • Weak password check. RFC 6143 says the standard VNC password method is “cryptographically weak and is not intended for use on untrusted networks”. The password is truncated to eight characters. That makes guessing passwords (see brute-force-attack) easier.
  • No encryption in the standard. The RFC’s security section says RFB provides no protection against observation or tampering, and suggests IPsec or SSH.
  • Botnets and targeted attackers. SecurityWeek says the Redheberg botnet infected nearly 40,000 exposed VNC servers since February 2026, and that Russia-linked hackers are known to target operational technology through VNC, as government agencies warned in December 2025.
  • Implementation flaws. Individual VNC products have their own CVEs. Check your product’s vendor advisories and patch accordingly. This entry does not cite a specific product CVE.

Who it affects and how badly

  • Sole trader to 10 staff (trades, retail, hospitality): a till, CCTV recorder or remote-support PC with VNC open. Worst case: someone watches and controls the screen, takes payment data, or uses the machine to reach the rest of the network.
  • 10 to 50 and 50 to 250 staff (manufacturing, construction, care homes, schools, recruitment): VNC left on from a past support job. Worst case: ransomware starting from that machine, with downtime across the site.
  • Regulated and 250 plus (healthcare, fintech, utilities, councils): VNC on shop-floor or building systems. Worst case: loss of control of physical systems, personal data exposure and reporting duties.

How to check whether yours is exposed

  1. Look at your firewall rules for any inbound rule to TCP 5900 to 5910, 5800 or 5500.
  2. Check your asset list for devices with VNC servers installed: remote-support PCs, kiosks, signage, Linux desktops, and building or factory control panels. The NCSC says an attacker can gain access through systems the organisation is not aware of, so identifying all assets is the first step.
  3. From outside your network, check your public IP addresses only for these ports, using an external view such as your provider’s tool or the free web vulnerability scan.
  4. On each machine, check which VNC product is installed and whether a password is set.

Only test addresses you own or have written permission to test.

How to secure it

  1. Do not expose VNC to the internet. The NCSC recommends a final “deny all” firewall rule after rules that allow only the minimum necessary access.
  2. Reach VNC only through an SSH tunnel or IPsec, as RFC 6143 suggests, or through a VPN or managed remote access gateway that does the same job.
  3. Never run VNC with the “None” security type, and set a strong, unique password where passwords are used.
  4. Add multi-factor authentication at the VPN or gateway (see multi-factor-authentication).
  5. Where possible, replace VNC with a remote access tool that has encryption and per-user accounts.
  6. Keep the VNC product patched, and remove it from machines that no longer need it.
  7. Use allow-lists so only named support addresses can connect (NCSC: allow lists uphold least privilege).
  8. Log connections and alert on any from unfamiliar addresses.

The UK angle

The NCSC’s network security fundamentals guidance says to identify all assets, because attackers often get in through systems the organisation does not know about, and recommends choosing protocols with security built in, with the example of HTTPS over HTTP. That is the same principle as keeping an unencrypted remote desktop protocol off the internet.

What we check on a test

A Wolfcore penetration tester looks at:

  • Which hosts in scope answer on 5900 to 5910, 5800 and 5500, and what the banner reveals.
  • Which RFB security type each server offers, and whether any accept no authentication.
  • Whether password limits, lockout and logging exist.
  • Whether the viewer path is reachable only through a VPN or gateway.
  • What an attacker could reach from a VNC session: other machines, shared credentials, the domain.

Related terms

port-3389-rdp, port-23-telnet, port-445-smb, nmap, remote-monitoring-and-management-tool-abuse, brute-force-attack

Browse the Ports and protocols category.

FAQ

Is port 5900 always open? No. It is only open if a VNC server is installed and running.

Is VNC encrypted? The RFB standard itself provides no encryption. RFC 6143 suggests IPsec or SSH for protection.

Can I just change the port? Changing the port does not fix weak or missing authentication. RFC 6143 itself describes several ports in use (5900+N, 5800 and 5500), so scanning has to cover a range, not one number.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at free web vulnerability scan and see our penetration testing service.