Security readout for executives and security teams
Plain-English summary
A Windows NT registry key that an important application relies on is configured with weak permissions, meaning users who should not have access can read or modify it. That opens the door for a local user to tamper with an application's behavior, escalate privileges, or destabilize the system. The public record does not name a specific product or fix, so this is a generic hardening finding rather than a single-vendor bug.
Executive priority
Low priority for most modern environments because Windows NT is well past end-of-life. Elevate priority only if legacy NT systems remain in production, in which case the broader end-of-life risk far outweighs this single hardening item.
Technical view
The CVE describes an unspecified "application-critical" Windows NT registry key whose Access Control List grants excessive rights to non-privileged principals. On Windows NT-era systems this typically enables local privilege escalation, persistence, or configuration tampering by allowing a low-privileged user to overwrite values a higher-privileged process trusts. The record contains no CVSS score, CWE, affected product, or vendor advisory, and predates modern CVE metadata standards.
Likely exposure
Exposure is limited to legacy Windows NT systems that are still in operation, which is rare in modern enterprises. Any organization running NT-era workloads for industrial control, legacy line-of-business apps, or archival virtual machines could still be affected if registry ACLs were never audited.
Exploitation context
There is no CISA KEV listing and no cited evidence of active exploitation. The entry is a generic 1999-era hardening advisory rather than a tracked vulnerability with public exploit code. Practical risk requires local access to a legacy NT host and knowledge of which registry key is misconfigured, neither of which is specified in the source bundle.
Researcher notes
The CVE record is deliberately generic and cites only the CVE Program entry, with no vendor, product, CPE, CVSS, or CWE assigned. Treat it as a hardening reminder rather than a discrete vulnerability. Any deeper analysis requires identifying the specific application and registry key at issue, which the public sources do not provide.
Mitigation direction
- Inventory any remaining Windows NT systems and prioritize their retirement or isolation.
- Audit registry key ACLs on critical application hives and restrict write access to SYSTEM and Administrators.
- Where retirement is not possible, place legacy hosts on segmented networks with strict local account controls.
- Consult vendor guidance for each legacy application to confirm required registry permissions.
Validation and detection
- Enumerate registry ACLs on application hives using tools such as AccessChk or Get-Acl and flag non-admin write permissions.
- Verify only Administrators and SYSTEM have write access to keys backing privileged services.
- Confirm legacy NT hosts are inventoried and reviewed in the asset management system.
- Review local user and group membership on legacy systems for unnecessary interactive accounts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0664 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cve.org/CVERecord?id=CVE-1999-0664CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.