HighExposed servicesBLWK-NET-001

A VNC/remote-desktop port is listening

What this means

Port ‹port› is listening on ‹listen address› — a standard VNC (5900-range) or noVNC/websockify (6080) port, reachable from the network. If this wasn't deliberately set up with a password and restricted access, it's a full remote-desktop backdoor. A listener bound only to loopback (127.0.0.1/::1) is deliberately excluded: that's the normal SSH-tunnel / container-published pattern and isn't remotely reachable.

How to fix it

If this isn't an intentional remote-desktop setup: stop the service (check ps aux for x11vnc/vncserver/websockify) and remove any systemd unit or cron entry that restarts it.

Check it yourself

Run a scan and look for BLWK-NET-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads listening_ports and reports this check when:

port in [5900, 5901, 5902, 6080] and loopback_only == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1219

Related checks

• A port commonly used by ngrok's local API is listening · BLWK-NET-002
• A database or development service is open to the network · BLWK-NET-003
• No host firewall is filtering incoming connections · BLWK-NET-004