Vulnerability record · CVE-2000-0979 · published 19 December 2000
CVE-2000-0979: Windows 9x/Me File and Print Sharing share password bypass
Microsoft · Windows 95
The File and Print Sharing service in Windows 95, 98, 98SE and Me fails to properly validate share passwords. A remote attacker can bypass share access controls by supplying a 1-byte password that matches only the first character of the real password, known as the "Share Level Password" vulnerability. It matters because it defeats the only access control protecting password-protected file shares on these legacy systems.
Description
File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability.
AV:N/AC:L/Au:N/C:P/I:P/A:N
Automated analysis
high priorityThe flaw allows unauthenticated remote bypass of share access controls with public exploit code available, though it affects only long end-of-life Windows 9x/Me systems.
What it is
The File and Print Sharing service in Windows 95, 98, 98SE and Me fails to properly validate share passwords. A remote attacker can bypass share access controls by supplying a 1-byte password that matches only the first character of the real password, known as the "Share Level Password" vulnerability. It matters because it defeats the only access control protecting password-protected file shares on these legacy systems.
Impact
An attacker gains read and write access to password-protected file shares without knowing the full password. This exposes or allows modification of shared files on the affected host.
Attack surface
Reachable over the network via the File and Print Sharing service (SMB/NetBIOS) with no authentication required beyond the trivially bypassed share password; no user interaction is needed. The CVSS vector AV:N/AC:L/Au:N/C:P/I:P/A:N confirms remote, low-complexity, unauthenticated access.
Exploitation
Public exploit code is referenced (SecurityFocus BID 1780 tagged Exploit), but the CVE is not listed in CISA KEV and no ransomware use is documented. EPSS is high (0.44987, 98.7th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply Microsoft security bulletin MS00-072 or the vendor patch for the affected Windows 9x/Me systems.
- Disable File and Print Sharing on any host that does not require it.
- Remove password protection reliance on share-level passwords; restrict shares to trusted networks only.
- Isolate or retire Windows 95/98/Me systems that cannot be patched, as they are end-of-life and unsupported.
Detection
- Monitor SMB/NetBIOS share access attempts with unusually short or single-character password submissions.
- Audit file share access logs for successful connections to password-protected shares from unexpected hosts.
- Baseline and alert on File and Print Sharing service exposure on legacy Windows 9x/Me systems.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2000-0979 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2000-0979), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
