5900
Summary
- // if you see it open
- Headline exposure: Forescout (May 2026, via Shodan) reported 1.6M+ VNC servers exposed, ~60,000 with authentication disabled, and 670+ of those fronting OT/ICS control panels. Cyble recorded a ~3x spike in attacks on 5900 (Jul–Aug 2022, 6M+ probe attempts). Classic VNC auth is a weak DES challenge-response, and many implementations truncate passwords to 8 chars; sessions unencrypted by default. Brute-force tooling standard (Metasploit vnc_login, Hydra, nmap vnc-brute). MITRE ATT&CK T1021.005 (FIN7, TrickBot, et al.). TightVNC CVE-2019-15679/15680.
- // common applications
- TightVNCRealVNCTigerVNCmacOS Screen Sharingx11vnc
- // analyst note
- An open 5900 = remote-desktop host and the highest-priority item in this batch. Check for no-auth/weak-auth and whether it fronts an ICS/OT system or jump host.
About port 5900/tcp.
Port 5900/tcp is the default port for VNC remote-desktop sessions, registered with IANA as rfb (Remote Framebuffer) with the description "Remote Framebuffer" and the reference [RFC6143]; it is the only port IANA allocated to the protocol (RFC 6143 §8 records the allocation, and IANA maintains a separate RFB sub-registry created in 2010). The Remote Framebuffer protocol, standardized as RFC 6143 (March 2011, Informational; authors Tristan Richardson and John Levine of RealVNC), is a pixel-based remote-GUI protocol built around a single graphical primitive — place a rectangle of pixel data at a given x,y — plus keyboard and pointer events, which makes it thin-client-friendly and widely portable. A defining operational detail is the display-number convention: a VNC server for display N listens on port 5900+N, so :1 is 5901 and :2 is 5902 (analogous to X11's 6000+N); port 5800 sometimes serves a Java-applet viewer over HTTP, and reverse "listening viewer" connections use 5500. The protocol's classic authentication is a weak DES-based challenge-response, and many VNC implementations silently truncate passwords to eight characters, leaving them inherently weak even where the session is otherwise protected; sessions are unencrypted by default. This is the headline security story of the batch: Forescout's May 2026 research, drawing on Shodan data, reported over 1.6 million VNC servers exposed to the internet, with nearly 60,000 having authentication disabled outright and more than 670 of those exposing OT/ICS control panels directly; Cyble recorded a roughly threefold spike in attacks against port 5900 between July and August 2022, exceeding six million probe attempts, and CISA and partners have warned of brute-forcing of exposed VNC. VNC appears in MITRE ATT&CK as T1021.005, used by numerous threat actors (FIN7, TrickBot, and others), and TightVNC carries CVE-2019-15679/15680. For an analyst, an open 5900 is the highest-priority item here: check immediately for no-auth or weak-auth and whether it fronts an ICS/OT system or a jump host.
- IANA assignment
rfb— "Remote Framebuffer"; reference [RFC6143]; 5900 is the only port allocated to RFB [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Prevalence
- in Nmap's default top-1000 TCP ports; commonly found open (de-facto, nmap-services) [Well-established] — nmap-services file
- Related ports
- 5800 (vnc-http / Java viewer), 5901/5902 (displays :1/:2), 5500 (reverse/listening viewer), 3389 (RDP)
Primary use
default VNC remote-desktop (RFB) listener
Other/unofficial uses
macOS Screen Sharing; RealVNC/TightVNC/UltraVNC; KVM-over-IP; ICS/OT HMIs [Well-established]
Security implications
massive internet exposure (Forescout May 2026: 1.6M+ exposed, ~60K no-auth, 670+ fronting ICS/OT); weak DES challenge-response and ≤8-char passwords; unencrypted by default; brute-force tooling standard; MITRE T1021.005 (FIN7, TrickBot, etc.); TightVNC CVE-2019-15679/15680
Typically seen on
remote-desktop hosts, macOS Screen Sharing, KVM-over-IP, ICS/OT HMIs, Raspberry Pi
- Analyst note
- An open 5900 = remote-desktop host and the highest-priority item in this batch. Check for no-auth/weak-auth and whether it fronts an ICS/OT system or jump host.
About port 5900/udp.
Port 5900/udp is registered with IANA under the service name rfb ("Remote Framebuffer"), assignee Tristan Richardson, with RFC 6143 as the registry reference and a registration date of March 2006; the same name is dual-registered on 5900/tcp with identical fields. RFB is the wire protocol that underpins VNC (Virtual Network Computing) graphical remote-desktop access, and Tristan Richardson is the protocol's originator. The important nuance for an analyst is the gap between the registry and reality: although 5900/udp carries the formal rfb assignment, every mainstream VNC implementation — RealVNC, TightVNC, UltraVNC, LibVNCServer, and vendor integrations such as Dell iDRAC — runs its sessions over TCP. RFC 6143 (published March 2011) notes that RFB "usually operates over a TCP/IP connection" while permitting any reliable transport; it neither mandates TCP nor precludes UDP, but in practice no significant software listens for VNC on UDP. Consequently, traffic seen on 5900/udp is almost always undifferentiated port-scanner noise rather than a real VNC-over-UDP service. Internet-exposure and scanning telemetry for port 5900 is overwhelmingly TCP-centric: Shadowserver's Accessible VNC Report (severity HIGH) tracks VNC on 5900–5905/tcp and 5800–5805/tcp and added unauthenticated-VNC detection (vnc-unauth) on 2025-05-01, and a Rapid7 NICER study fingerprinted roughly 347,940 nodes on 5900–5901/tcp. The documented security risks — brute-force against weak VNC authentication, unauthenticated access, plaintext session data — are TCP-specific, and no CVE or active-exploitation vector targets 5900/udp specifically as of this research pass. For an analyst, a UDP listener actually answering on 5900 is anomalous and worth investigating rather than assuming a benign VNC service.
- IANA assignment
rfb— "Remote Framebuffer"; reference [RFC6143]; assignee [Tristan_Richardson]; registration date 2006-03; dual-registered 5900/tcp + 5900/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)- Range class
- registered (1024–49151)
- Related ports
- 5901–5905/tcp (additional VNC displays), 5800–5805/tcp (VNC-over-HTTP / Java applet); contrast 3389/tcp (RDP)
Primary use
Remote Framebuffer (RFB) protocol underlying VNC graphical remote desktop; RFC 6143 permits any reliable transport but VNC universally uses TCP
Common software
RealVNC, TightVNC, UltraVNC, LibVNCServer, Dell iDRAC — all use TCP for session traffic; none use UDP 5900 as a primary listener
Exposure / scanning
port-5900 exposure and scanning data is TCP-dominated — Shadowserver Accessible VNC Report (severity HIGH; vnc-unauth detection added 2025-05-01) covers 5900–5905/tcp + 5800–5805/tcp; Rapid7 NICER fingerprinted ~347,940 nodes on 5900–5901/tcp; no UDP-specific scan breakdown is published
Security implications
documented risks are TCP-specific (brute-force on weak VNC auth, unauthenticated access, plaintext sessions); UDP 5900 is not a known active exploitation vector and no CVE targets it specifically as of mid-2026
- UDP-specific reality
- no mainstream service uses 5900/udp as a primary listener; UDP traffic on this port in passive scan data is most likely undifferentiated reconnaissance noise, not a purposeful VNC-over-UDP deployment [Likely] — RFC 6143; Wireshark PortReference Ports5900to5999
- Registry blanks
- modification date, service code, unauthorized-use-reported, and assignment-notes columns are blank in the IANA registry (confirmed blank, reported as null) [Confirmed] — IANA registry
- Analyst note
- The
rfbassignment is real, but a UDP listener actually responding on 5900 is anomalous — real VNC is TCP, so investigate UDP activity as scanner noise or an atypical service rather than a normal VNC session.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| vnc | TCP | rfb | 2.36% |
| rfb | UDP | Remote Framebuffer | 0.07% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.