Port 5900 (VNC)
Virtual Network Computing remote desktop (display :0; :1 is 5901 and so on).
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Many VNC servers are found online with no password or a weak one.
- Traffic is often unencrypted.
When it shows up in your logs
Inbound VNC from the internet is scanning; unexpected internal VNC can be remote control by an attacker.