Security readout for executives and security teams
Plain-English summary
This issue affects SMB authentication in Windows 95 and Windows 98. The authentication challenge can be reused, allowing a captured response to be replayed so an attacker may impersonate a user. The source bundle does not provide CVSS, patch status, or evidence of active exploitation.
Executive priority
Prioritize this only if legacy Windows 95 or Windows 98 systems still exist or support business processes. For most modern environments, urgency is likely low, but unsupported SMB hosts create avoidable identity and lateral-movement risk.
Technical view
CVE-1999-0391 describes reusable cryptographic challenges in SMB authentication on Windows 95 and Windows 98. Reuse enables replay of an authentication response and user impersonation. Available evidence is limited to the CVE record and a Bugtraq-era reference; no affected build matrix, patch identifier, or exploit telemetry is provided.
Likely exposure
Exposure appears limited to legacy Windows 95 or Windows 98 systems using SMB authentication. Modern products, other Windows versions, and specific configurations are not identified in the provided sources.
Exploitation context
The issue is a replay risk against SMB authentication. The bundle marks CISA KEV as false and provides no cited evidence of active exploitation, public weaponization, or current targeting.
Researcher notes
Evidence is sparse and historical. The affected scope is stated as Windows 95 and Windows 98 SMB authentication only. Do not generalize to newer Windows versions without separate evidence. No CVSS, CWE, patch, or active exploitation source is included.
Mitigation direction
- Inventory Windows 95 and Windows 98 systems using SMB.
- Check vendor or archival guidance for confirmed fixes or configuration changes.
- Retire unsupported legacy SMB hosts where business use is no longer required.
- Restrict access to any remaining legacy SMB services.
- Monitor legacy SMB access for unexpected authentication activity.
Validation and detection
- Confirm whether Windows 95 or Windows 98 hosts remain in the environment.
- Identify whether SMB file or printer sharing is enabled on those hosts.
- Review network controls limiting access to legacy SMB services.
- Check records for any historical vendor remediation applied.
- Document unsupported systems requiring retirement or compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0391 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://marc.info/?l=bugtraq&m=91552769809542&w=2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.