Port 5900 – VNC

TCP

Port 5900 is the VNC (Virtual Network Computing) remote desktop port. VNC provides platform-independent graphical remote access. The base protocol on port 5900 has weak encryption (DES with 8-char password limit) – always tunnel VNC through SSH or VPN. Additional displays use ports 5901, 5902, etc.

Port Number

5900

Protocol

TCP

Service

Virtual Network Computing

Range

IANA Registered (1024–49151)

Description

VNC on port 5900 provides remote framebuffer access for graphical desktop sharing. The RFB (Remote Framebuffer) protocol transmits screen updates and receives keyboard/mouse input. Port numbering follows display number: display :0 = port 5900, display :1 = port 5901. VNC's built-in security is inadequate for direct internet exposure. The original VNC authentication uses DES encryption with passwords truncated to 8 characters – brute-forceable in minutes. Even VNC implementations with better auth (RealVNC, TightVNC) should be tunneled through SSH (ssh -L 5900:localhost:5900 host) or accessed via VPN. Never expose port 5900 directly to the internet.

Security risks

1CVE-2019-15678: TightVNC heap buffer overflow – crafted RFB protocol message causes RCE on the VNC server (CVSS 9.8, affects many VNC implementations)
2Password-only authentication: most VNC implementations use a single shared password (max 8 characters in original RFB!) with no username. 8-char DES-encrypted passwords are trivially brute-forced
3No encryption in standard RFB: VNC's Remote Framebuffer protocol transmits all screen content, keystrokes (including passwords being typed), and mouse movements in cleartext
4Exposed VNC instances indexed by Shodan: over 8,000 VNC servers with no authentication are publicly accessible. Screen content is visible without any interaction
5Port 5900+N pattern: VNC uses 5900 for display :0, 5901 for display :1, etc. Scanning 5900-5910 often finds multiple VNC sessions on the same host

Firewall guidance

NEVER expose port 5900 to the internet. VNC has weaker security than RDP (which is already dangerous to expose). Access only via: (1) SSH tunnel: ssh -L 5900:localhost:5900 host, then connect VNC client to localhost:5900. (2) VPN. (3) For web-based access: noVNC behind an authenticated reverse proxy. RealVNC Enterprise adds proper encryption and auth but is paid.

Diagnosis commands

Detect VNC version and authentication requirements

shell

nmap -p 5900 --script vnc-info target

Brute-force VNC password (security audit, max 8 chars to test)

shell

nmap -p 5900 --script vnc-brute target

List all VNC listeners (5900, 5901, etc.)

shell

ss -tlnp | grep 590

List running VNC sessions on the server

shell

vncserver -list

Usage examples

Port 5900 – VNC

shell

vncviewer localhost:5900
ssh -L 5900:localhost:5900 user@host
x11vnc -display :0 -rfbport 5900

Common services on this port

TigerVNCTightVNCRealVNCx11vncmacOS Screen SharingnoVNC (WebSocket)

Related ports

5900

VNC display :0 (this port)

5901

VNC display :1

5800

VNC HTTP viewer (Java applet, legacy)

3389

RDP (Windows native remote desktop)

History

VNC (Virtual Network Computing) was created at AT&T's Olivetti Research Laboratory in Cambridge (1998). The RFB (Remote Framebuffer) protocol uses port 5900+ per display. VNC was designed for LAN use with no security considerations. Over 20 implementations exist (TigerVNC, TightVNC, RealVNC, UltraVNC, x11vnc). Despite being insecure by design, VNC remains widely used because: it's cross-platform, free, simple, and works for headless Linux servers where RDP isn't available.

FAQ

VNC vs RDP vs SSH X11 forwarding?

VNC: cross-platform, sees the actual console session (good for Linux desktops), no encryption by default, shared password only. RDP: Windows-native, per-user sessions (each user gets isolated desktop), NLA+TLS encryption, clipboard/audio/drive redirection. SSH X11: forwards individual applications (not full desktop), encrypted by SSH, high latency for complex UIs. For Linux servers: SSH + tmux (no GUI). For Linux desktops: VNC over SSH tunnel. For Windows: RDP via VPN/Gateway.

How do I secure VNC access?

The only secure way to use VNC: tunnel it through SSH (ssh -L 5900:localhost:5900 server, then connect to localhost:5900). VNC should listen on 127.0.0.1 ONLY (vncserver -localhost yes or x11vnc -localhost). For web access: deploy noVNC behind nginx with TLS + basic auth + IP restriction. If you need enterprise VNC: RealVNC Connect provides proper encryption, 2FA, and audit logging (paid product).

Specification

RFC 6143 – Port 5900 specification →