CVE-1999-1266: rsh daemon (rshd) generates different error messages when a valid username is provided versus an invalid na...

Security readout for executives and security teams

This CVE describes a username enumeration weakness in rshd. A remote party can tell whether a username exists because the service returns different errors for valid and invalid names. By itself, this is information disclosure, but it can support later password guessing or targeting if rsh remains exposed. Exposure is most likely on legacy systems where the rsh daemon is enabled and reachable. The provided sources list vendor and product as n/a, so vulnerability managers should not assume a specific platform without local inventory and vendor confirmation. Treat this as a legacy exposure cleanup item unless rshd is externally reachable. The main business concern is attacker reconnaissance against valid accounts, especially in environments that still operate old remote shell services. Mitigation focus: Identify whether rshd is enabled on any managed systems.; Disable rshd where it is not operationally required.; Restrict reachable rshd services to trusted administrative networks only..

Prepared

Jul 1, 2026, 09:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.