A second VNC desktop on the same host — display :2.
5902 is 5900 plus display 2. Finding it open means the host is running more than one VNC session at once: a second user on a shared Linux machine, a second virtual machine console on a KVM or Proxmox host, or a second vncserver instance for a different desktop environment. The protocol is identical to 5900 and 5901 — a plaintext RFB version banner, then authentication.
Do not expose
Every additional VNC display multiplies the same weak, unencrypted authentication surface. Keep all of them on the loopback interface behind SSH or a VPN.
$ nc -w 3 TARGET 5902 | head -c 12; echoSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.