Remote accessTCP 5900 Cleartext by default
Port 5900: VNC
Virtual Network Computing
Cross-platform remote desktop. Display :0 listens on 5900, :1 on 5901 and so on.
How attackers abuse it
- Weak or no passwords; classic VNC authentication is weak and traffic is often unencrypted.
- Exposed HMIs in OT environments.
How to defend it
- Tunnel VNC over SSH or a VPN.
- Strong authentication; never expose it to the internet.
Exam tip
Treat VNC like Telnet for desktops unless it is tunnelled.