Security readout for executives and security teams
Plain-English summary
A legacy Windows NT configuration issue allowed non-administrator users to reach the system registry over the network. The registry holds core settings for the operating system, so remote access by ordinary users increased the chance that sensitive configuration could be read or altered. This is a very old advisory from 1999 and is only relevant to environments still running unsupported Windows NT systems.
Executive priority
Low operational priority for modern environments; treat as a legacy hygiene item. If any Windows NT systems remain in production, elevate to a targeted decommissioning or isolation project because the platform is unsupported and carries broader risk beyond this single CVE.
Technical view
CVE-1999-0562 documents that the Windows NT registry could be accessed remotely by users who were not administrators, due to permissive default access controls on the remote registry interface. The source bundle provides no CVSS score, CWE mapping, or specific affected version list, and references an OVAL definition (def:1023) as the primary technical artifact. No patch identifier is cited in the bundle.
Likely exposure
Exposure is limited to legacy Windows NT hosts where the Remote Registry service is reachable and default ACLs on the winreg key were not hardened. Modern, supported Windows versions are not in scope. Any organization still operating NT-era systems in reachable network segments should assume exposure until proven otherwise.
Exploitation context
The source bundle does not indicate CISA KEV listing or confirmed in-the-wild exploitation. No public exploit status is cited. Given the age of the advisory (published 2000) and the discontinuation of Windows NT support, contemporary exploitation telemetry is not present in the provided sources.
Researcher notes
Bundle lacks CVSS, CWE, and explicit affected product enumeration. The single technical reference is an OVAL definition (oval:org.mitre.oval:def:1023). No KEV listing and no patch citation are present. Analysts should treat the record as historical documentation of a Windows NT default-configuration weakness rather than an actionable modern vulnerability, and defer to Microsoft legacy documentation for definitive remediation.
Mitigation direction
- Inventory any remaining Windows NT systems and plan migration off unsupported platforms.
- Consult Microsoft legacy guidance on restricting the winreg key ACL to administrators.
- Disable the Remote Registry service on hosts where it is not required.
- Restrict SMB and RPC access to legacy hosts using network segmentation and firewall rules.
- Where migration is not immediate, isolate NT hosts on dedicated management VLANs.
Validation and detection
- Enumerate hosts still running Windows NT via asset inventory or network fingerprinting.
- Review ACLs on HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg on any legacy NT hosts.
- Confirm Remote Registry service status on identified legacy systems.
- Verify network reachability of ports 139/445 to legacy hosts from untrusted segments.
- Cross-check findings against the OVAL definition referenced in the CVE record.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0562 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- oval:org.mitre.oval:def:1023CVE reference · vdb-entry, signature
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.