Internet-Security.com TCP port 5902 details

TCP port 5902 is used by VNC servers implementing the RFB protocol as the listener for display :2 (ports are 5900 + display number).
RealVNC Server (including on Raspberry Pi OS in “virtual desktop” mode) uses 5902 for its second virtual session (:2).
TightVNC, UltraVNC, TigerVNC, and x11vnc follow the same convention; their second instance typically listens on 5902.
QEMU/KVM’s built-in VNC console (often managed via libvirt/virt‑manager) exposes VM consoles on 5900+N, so a third VM commonly appears on 5902.
VMware Workstation/ESXi can enable a VNC remote console and administrators often assign ports in the 5900 range; 5902 is commonly used for an additional VM console.
Multi-user Xvnc/TigerVNC setups in UNIX/Linux labs typically allocate 5902 for a user session mapped to display :2.
Security note: VNC services on 5902 are frequently targeted for scanning, brute-force attacks, and unauthorized access when exposed to the internet or misconfigured.

TCP 5902