{
  "port": 5902,
  "protocol": "tcp",
  "service": "VNC (RFB) display :2",
  "oneLiner": "A second VNC desktop on the same host — display :2.",
  "whatItIs": "5902 is 5900 plus display 2. Finding it open means the host is running more than one VNC session at once: a second user on a shared Linux machine, a second virtual machine console on a KVM or Proxmox host, or a second `vncserver` instance for a different desktop environment. The protocol is identical to 5900 and 5901 — a plaintext RFB version banner, then authentication.",
  "exposure": {
    "verdict": "never",
    "note": "Every additional VNC display multiplies the same weak, unencrypted authentication surface. Keep all of them on the loopback interface behind SSH or a VPN."
  },
  "checkCommand": "nc -w 3 TARGET 5902 | head -c 12; echo",
  "links": [
    {
      "title": "RFC 6143 — The Remote Framebuffer Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc6143",
      "kind": "spec"
    },
    {
      "title": "TigerVNC/tigervnc",
      "url": "https://github.com/TigerVNC/tigervnc",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 5902 (unassigned; 5900 is rfb)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5902",
      "kind": "iana"
    }
  ]
}