CVE-1999-0502: Unix accounts with default, null, or blank passwords

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityBlank or default credentials give unauthenticated network access to Unix accounts, and the high EPSS score shows this class of weakness is actively targeted, though the record lacks patch and version specifics.

What it is

CVE-1999-0502 covers Unix accounts that are configured with a default, null, blank, or missing password. It is a configuration weakness rather than a software bug, and it matters because any account left in this state can be logged into without knowing a password. The record is very thin: no affected version detail, no patch reference, and only generic X-Force links.

Impact

An attacker who can reach the login service gains access to the affected account, and with it whatever privileges that account holds, including root if the account is privileged. That access can be used for further compromise of the host.

Attack surface

Reached over the network through standard Unix login services such as telnet, rlogin, or console login; the CVSS 2.0 vector AV:N/AC:L/Au:N indicates no authentication is required and no user interaction is needed. The description does not identify a specific service or port.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is high at 0.533 (99th percentile), indicating substantial observed likelihood of exploitation. The two references carry no tags and provide no exploit detail.

What to do

• Audit all Unix accounts for empty, null, or default passwords and lock or remove any that are not required.
• Enforce a password policy that rejects blank and default credentials, and set expiry on service and vendor accounts.
• Disable or restrict remote login services (telnet, rlogin, rsh) in favor of SSH with key or strong password authentication.
• Apply vendor security updates for HP-UX, Linux, Solaris, and SunOS where default account configurations are addressed.
• Restrict network access to login services with host firewalls or TCP wrappers.

Detection

• Scan /etc/passwd and /etc/shadow for accounts with empty password fields or known default hashes.
• Monitor authentication logs for successful logins to accounts that should be disabled or that have no password change history.
• Alert on repeated failed-then-successful login patterns against privileged accounts from unexpected source addresses.
• Run periodic configuration compliance checks against baseline account and password settings on Unix hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.