CVE-2022-25227

Name of the Vulnerable Software and Affected Versions Thinfinity VNC version 4.0.0.1

Description The issue allows an unprivileged remote attacker to obtain an ID that can be used to send websocket requests and achieve remote code execution (RCE) if they can trick a user into browsing a malicious site. This is due to a Cross-Origin Resource Sharing (CORS) vulnerability.

Recommendations For Thinfinity VNC version 4.0.0.1, as a temporary workaround, consider restricting access to the websocket endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.