Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER DualDesk v20 Proxy.exe long string denial of service attempt

Rule Explanation

This event is generated when an attempt to cause a denial of service to DualDesk Proxy application occurs. Impact: Attempted Denial of Service Details: Unauthenticated remote attackers can crash the DualDesk Proxy application by sending a long string to TCP ports 5500 and 5900. Ease of Attack: Simple. Proof of concept is available.

What To Look For

Known Usage

No public information

False Positives

Known false positives, with the described conditions

Very FP prone due to the fact that VNC and other servers can easily use TCP ports 5500 and 5900.


Cisco Talos Intelligence Group

MITRE ATT&CK Framework



For reference, see the MITRE ATT&CK vulnerability types here:


Rule Vulnerability

CVE Additional Information

Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.
Severity Base Score7.5
Impact Score3.6 Exploit Score3.9
Confidentiality ImpactNONE Integrity ImpactNONE
Availability ImpactHIGH Access Vector
Authentication Ease of Access