CVE-2016-5008: libvirt: Setting empty VNC password allows access to unauthorized users

Severity: Critical

CVSS Score: 9.8

libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.