Vulnerability record · CVE-1999-0504 · published 1 January 1997
CVE-1999-0504: Windows NT/2000 default or blank account password
Microsoft · Windows 2000
Windows NT and Windows 2000 local user or administrator accounts can be configured with a default, null, blank, or missing password. This leaves accounts accessible with no credential, which matters because such accounts often hold administrative rights on the host.
Description
A Windows NT local user or administrator account has a default, null, blank, or missing password.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityThe flaw allows unauthenticated access to potentially privileged accounts, and the very high EPSS score signals strong exploitation likelihood despite the absence of KEV listing.
What it is
Windows NT and Windows 2000 local user or administrator accounts can be configured with a default, null, blank, or missing password. This leaves accounts accessible with no credential, which matters because such accounts often hold administrative rights on the host.
Impact
An attacker who reaches the account can log in without a password and gain the privileges of that user, including administrator rights if the blank-password account is privileged.
Attack surface
The CVSS 2.0 vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and no user interaction, though the description frames it as a local account condition. The record does not specify which services or protocols expose the login.
Exploitation
Not listed in CISA KEV and no exploit tags are present in the references, but EPSS is 0.64277 (99.193 percentile), indicating a high modeled likelihood of exploitation activity.
What to do
- Apply current Microsoft security updates for the affected Windows NT and Windows 2000 systems, or migrate off these end-of-life platforms.
- Audit all local and administrator accounts and set strong, non-blank passwords; disable or remove unused accounts.
- Enforce a password policy that rejects blank and default passwords across the domain and local SAM.
- Restrict network exposure of authentication services (SMB, RDP, and similar) to trusted networks only.
- Monitor for and remediate any account still using a default or vendor-supplied password.
Detection
- Audit local and domain accounts for blank, null, or default passwords using account policy and password auditing tools.
- Alert on successful authentications to accounts that should have no interactive logon or that have never had a password set.
- Review authentication logs for logons from unexpected hosts or at unusual times to accounts with weak or missing credentials.
- Scan hosts for exposed authentication services reachable from untrusted network segments.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-1999-0504 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-1999-0504), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
