CVE-2002-0971

MEDIUM

Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" ...

Affects 3 products across 3 vendors.

CVSS 2.04.6
EPSS0.4%
Percentile32th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity.
◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2002. A medium severity vulnerability affects Att systems (CVE-2002-0971). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2002-GLOBAL-346635-M • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2002-0971?
This vulnerability was disclosed in 2002. A medium severity vulnerability affects Att systems (CVE-2002-0971). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2002-0971?
CVE-2002-0971 has CVSS 4.6 (Medium). Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P. EPSS: 0.4%.
Is CVE-2002-0971 actively exploited?
No confirmed active exploitation of CVE-2002-0971 as of 2026-05-30.
How do I remediate CVE-2002-0971?
Priority: MONITOR.
What systems are affected by CVE-2002-0971?
CVE-2002-0971 affects Att Winvnc Server; Tightvnc Tightvnc; Tridia Tridiavnc.
Vulnerability Details
CVE IDCVE-2002-0971
BSIDBS-2002-GLOBAL-346635-M BreachSpider Global ID
CVSS VectorAV:L/AC:L/Au:N/C:P/I:P/A:P
Published2002-09-24
Last Modified2026-04-16
ICS Relevance0%
SourceNVD
Official Description

Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box. CVSS vector: AV:L/AC:L/Au:N/C:P/I:P/A:P.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Att Winvnc Server ≤ 3.3.3_r9
Tightvnc Tightvnc 1.2.0 1.2.1 1.2.5
Tridia Tridiavnc 1.5 1.5.1 1.5.2 1.5.4
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 8788 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashbff5360c0b103ce1c9c97d1a503d53e3b9d53de679bf30884dcd2ba338ead57d1bc1993b5a662af2fc03284a4a91bfb6466df8af0ce9a332e9467886af2a204f
Related CVEs affecting Att
CVE-2001-0168 10.0 Buffer overflow in AT&T WinVNC (Virtual Network Computing) server 3.3.3r7 and... CVE-1999-1059 10.0 Vulnerability in rexec daemon (rexecd) in AT&T TCP/IP 4.0 for various SVR4 sy... CVE-2021-21830 9.8 A heap-based buffer overflow vulnerability exists in the XML Decompression La... CVE-2021-21829 9.8 A heap-based buffer overflow vulnerability exists in the XML Decompression En... CVE-2021-21810 9.8 A memory corruption vulnerability exists in the XML-parsing ParseAttribs func...
View all Att CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →