CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Remote access

Port 5900: VNC

VNC remote desktop. Displays 5901, 5902... map to additional screens.

Remote FramebufferrfbRealVNCTightVNC
5900

How VNC works

Remote access
viewer:5900clicks, keysscreen viewer:5900clicks, keysscreen

The server streams its screen to the client, and the client sends back mouse clicks and keystrokes. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
9/10 critical if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
Remote access
01 Security

Is port 5900 dangerous?

Common attacks and weaknesses

  • Servers without password, or with 8-character passwords easily brute forced.
  • Unencrypted sessions.
  • Exposed industrial HMIs and home computers.

How to secure it

  • Never expose VNC directly: tunnel it through SSH or a VPN.
  • Set a strong password and enable encryption if supported.
  • Prefer a managed remote access solution with MFA.
02 Registry

IANA registry entries for port 5900

ServicePortTransportDescriptionReferenceUpdated
rfb 5900 TCP, UDP Remote Framebuffer RFC 6143 2006-03

// source: IANA service name and port number registry

03 Check it

Which program uses port 5900, and is it reachable?

Linux

sudo ss -ltnup 'sport = :5900'      # process listening on 5900
sudo lsof -nP -i :5900

macOS

sudo lsof -nP -i :5900

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5900 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 5900
netstat -ano | findstr :5900

From another machine

nmap -p 5900 -sV <host>
sudo nmap -sU -p 5900 <host>
nc -zv <host> 5900

Block it in the firewall

sudo ufw deny 5900/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 5900" -Direction Inbound -LocalPort 5900 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 5900 used for?

VNC remote desktop. Displays 5901, 5902... map to additional screens.

Is port 5900 TCP or UDP?

Port 5900 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 5900?

It is rated 9/10 (critical) when exposed to the Internet. Servers without password, or with 8-character passwords easily brute forced. Never expose VNC directly: tunnel it through SSH or a VPN.

How do I check if port 5900 is open?

On Linux run "ss -ltnup 'sport = :5900'", on macOS "lsof -nP -i :5900", and on Windows "netstat -ano | findstr :5900" to see the local process. From another machine, "nmap -p 5900 <host>" shows whether it is reachable.

05 Related
:22 SSH tcp · udp · sctp · moderate risk :3389 RDP tcp · udp · critical risk :23 Telnet tcp · udp · critical risk :5985 WinRM (HTTP) tcp · udp · high risk :5986 WinRM (HTTPS) tcp · udp · high risk :10000 Webmin tcp · udp · high risk :89 SU/MIT Telnet Gateway tcp · udp :107 Remote Telnet Service tcp · udp

Latest vulnerability news

All news