Analyst readout for executives and security teams
Plain-English summary
CVE-2004-1750 is a denial-of-service issue in RealVNC 4.0 and earlier. A remote attacker could crash the service by making many connections to TCP port 5900. The sources do not identify data theft or code execution, but loss of remote administration access can still disrupt operations.
Executive priority
Prioritize if VNC is exposed externally or supports critical remote administration. Treat internal-only legacy systems as lower urgency but still plan removal or upgrade.
Technical view
The CVE describes a remotely triggerable crash condition in RealVNC 4.0 and earlier caused by a large number of connections to the VNC service port, typically TCP/5900. The provided sources do not include CVSS, CWE, exploit maturity, or a named fixed version.
Likely exposure
Exposure is most likely where legacy RealVNC 4.0 or earlier is running and TCP/5900 is reachable from untrusted networks. Internet-exposed VNC services have the highest operational risk.
Exploitation context
The source bundle states remote attackers can cause a crash via many connections. It does not show CISA KEV listing, active exploitation evidence, exploit code, or confirmed real-world campaigns.
Researcher notes
Evidence is limited to advisory-style descriptions. The record names RealVNC 4.0 and earlier and a connection-volume crash on port 5900, but lacks root cause, patch details, CVSS, CWE, and exploitation status.
Mitigation direction
- Identify and retire or upgrade RealVNC 4.0 and earlier installations.
- Restrict TCP/5900 access to trusted networks or VPN paths only.
- Check RealVNC and referenced advisory guidance for fixed versions or vendor workarounds.
- Monitor VNC services for connection floods and repeated crashes.
- Disable unused VNC services, especially on internet-facing hosts.
Validation and detection
- Inventory hosts listening on TCP/5900 and confirm RealVNC version where present.
- Review firewall rules for untrusted access to VNC services.
- Check service logs for repeated connection spikes or unexplained crashes.
- Confirm whether any RealVNC 4.0 or earlier systems remain in production.
- Document compensating controls if immediate upgrade is not possible.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2004-1750 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 13143CVE reference · third-party-advisory, x_refsource_SECUNIA
- 11048CVE reference · vdb-entry, x_refsource_BID
- realvnc-multiple-connections-dos(17123)CVE reference · vdb-entry, x_refsource_XF
- 20040825 RealVNC 4.0 DoSCVE reference · mailing-list, x_refsource_BUGTRAQ
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.