CVE-1999-0502

EXPLOITED

HP-UX - Unauthenticated Remote Login via Default Null Password

Title source: llm
STIX 2.1

Exploitation Summary

CVE-1999-0502 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 25 public exploits from researchers including Metasploit, jduck, theLightCosine, including a Metasploit module auxiliary/scanner/rservices/rsh_login.

AI-analyzed exploit summary This Metasploit module exploits weak SSH credentials (CVE-1999-0502) to execute arbitrary commands via SSH. It supports multiple platforms and payload types, leveraging SSH authentication for remote code execution.

Description

A Unix account has a default, null, blank, or missing password.

Exploits (25)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/41694

This Metasploit module exploits weak SSH credentials (CVE-1999-0502) to execute arbitrary commands via SSH. It supports multiple platforms and payload types, leveraging SSH authentication for remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: SSH servers with weak credentials
Auth required
Prerequisites: Valid SSH credentials (username/password) · SSH service exposed on target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
by jduck · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/rservices/rsh_login.rb

This Metasploit module exploits weak authentication in rsh (CVE-1999-0502) by brute-forcing credentials and establishing a command shell. It requires privileged port access and tests for successful logins without passwords.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: rsh (remote shell service)
Auth required
Prerequisites: privileged port access (below 1024) · valid user credentials or weak passwords
devstral-2 · analyzed Jun 05, 2026 Full analysis →
metasploit SCANNER
by jduck · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/rservices/rlogin_login.rb

This Metasploit module scans for rlogin services and performs authentication brute-forcing. It does not exploit a specific vulnerability but checks for weak credentials, referencing CVE-1999-0502 (weak password) and CVE-1999-0651.

Classification
Scanner 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: rlogin service
Auth required
Prerequisites: access to privileged ports (below 1024) · valid user/password list for brute-forcing
devstral-2 · analyzed Jun 05, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/telnet/telnet_login.rb

This Metasploit module scans for Telnet services and attempts to authenticate using provided credentials. It reports successful logins and can optionally create a session upon successful authentication.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Telnet services (various versions)
Auth required
Prerequisites: Network access to target Telnet service · Valid or brute-forced credentials
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/telnet/brocade_enable_login.rb

This Metasploit module scans Brocade network devices for privileged logins by testing credentials, optionally extracting usernames from device configurations. It leverages Telnet for authentication brute-forcing and session creation upon successful login.

Classification
Scanner 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Brocade network devices (e.g., ICX6450-24, FastIron WS 624)
Auth required
Prerequisites: Telnet access to the target device · Device configured with 'aaa authentication enable default local' · Telnet authentication not explicitly enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by theLightCosine · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/vmware/vmware_http_login.rb

This Metasploit module scans for VMware HTTP services and attempts to authenticate using brute-force credentials. It identifies VMware products via SOAP requests and reports successful logins.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: VMware Server, ESX, ESXi
Auth required
Prerequisites: Network access to VMware HTTP service (typically port 443) · Valid or brute-forced credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by theLightCosine · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/vmware/vmauthd_login.rb

This Metasploit module is a login scanner for VMware Authentication Daemon (vmauthd) that performs brute-force authentication attempts. It checks for valid credentials and reports successful logins.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: VMware Authentication Daemon (vmauthd)
No auth needed
Prerequisites: Network access to the target service on port 902
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by thelightcosine, smashery · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/winrm/winrm_login.rb

This Metasploit module is a WinRM login utility designed to authenticate against a WinRM service using NTLM or Kerberos. It supports credential brute-forcing and session creation upon successful authentication.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Windows Remote Management (WinRM)
Auth required
Prerequisites: WinRM service with Negotiate(NTLM) or Kerberos authentication enabled · Valid credentials or a weak password for brute-forcing
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/mysql/mysql_login.rb

This Metasploit module is a MySQL login scanner that attempts to brute-force credentials (default: root with blank password) against MySQL servers. It checks the MySQL version and supports session creation if credentials are successful.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: MySQL (versions 4.1.1 and later)
No auth needed
Prerequisites: Network access to MySQL server · MySQL server with weak or default credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
by hdm · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/dlink_dir_session_cgi_http_login.rb

This Metasploit module attempts to authenticate to D-Link HTTP management services by brute-forcing credentials. It targets D-Link DIR-300B, DIR-600B, DIR-815, and DIR-645 devices via the `/session.cgi` endpoint.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: D-Link DIR-300B, DIR-600B, DIR-815, DIR-645
No auth needed
Prerequisites: Network access to the target device · HTTP/HTTPS service running on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb

This Metasploit module is a credential brute-forcing scanner for WordPress XML-RPC interfaces. It attempts to authenticate using provided username/password combinations and reports successful logins.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: WordPress (unspecified version)
No auth needed
Prerequisites: WordPress XML-RPC interface enabled · Valid username/password list
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/joomla_bruteforce_login.rb

This Metasploit module performs a brute-force login attack against Joomla 2.5 or 3.0 by attempting to authenticate using provided username and password lists. It checks for successful login by analyzing HTTP responses and error messages.

Classification
Scanner 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Joomla 2.5 or 3.0
No auth needed
Prerequisites: Access to the Joomla login page · Wordlists for usernames and passwords
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by hdm · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/dlink_dir_300_615_http_login.rb

This Metasploit module attempts to authenticate to D-Link HTTP management services by brute-forcing credentials. It targets D-Link DIR-300A, DIR-320, and DIR-615D devices with weak or default passwords.

Classification
Scanner 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: D-Link DIR-300A, DIR-320, DIR-615D (Mathopd/1.5p6)
No auth needed
Prerequisites: Network access to the target device · HTTP/HTTPS service exposed
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/dell_idrac.rb

This Metasploit module attempts to authenticate to Dell iDRAC web interfaces using default credentials. It supports multiple iDRAC versions (6-9) and includes brute-forcing capabilities with user/password wordlists.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Dell iDRAC (versions 6-9)
No auth needed
Prerequisites: Network access to iDRAC web interface · Default credentials or weak passwords
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by hdm · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/dlink_dir_615h_http_login.rb

This Metasploit module attempts to authenticate to D-Link DIR-615H HTTP management services by brute-forcing credentials. It includes functionality to detect D-Link devices and report successful logins.

Classification
Scanner 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: D-Link DIR-615H (tested on firmware v8.04)
No auth needed
Prerequisites: Network access to the target device · Default or weak credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by hdm · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/http_login.rb

This Metasploit module is a credential brute-forcing utility for HTTP services, attempting to authenticate against various URIs using provided or default wordlists. It supports multiple HTTP methods and success code configurations.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Generic HTTP services
No auth needed
Prerequisites: Access to HTTP/HTTPS service · Wordlists for credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by MC · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb

This Metasploit module attempts to brute-force or validate credentials for the Tomcat Application Manager by sending HTTP requests and checking for successful authentication responses. It supports both single credential testing and dictionary-based brute-forcing.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Apache Tomcat (multiple versions, including default installations with weak credentials)
Auth required
Prerequisites: Network access to Tomcat Manager interface · Valid or weak credentials
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by todb · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/db2/db2_auth.rb

This Metasploit module performs a brute-force authentication attack against DB2 instances using provided username and password combinations. It is designed to test weak credentials and does not contain any exploit payload.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: IBM DB2
No auth needed
Prerequisites: Network access to the DB2 instance · Valid username/password wordlists
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by theLightCosine · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/pcanywhere/pcanywhere_login.rb

This Metasploit module scans for weak pcAnywhere credentials by brute-forcing logins over TCP port 5631. It performs a handshake with the service and attempts authentication with provided username/password combinations.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Symantec pcAnywhere (versions with weak password vulnerability, CVE-1999-0502)
Auth required
Prerequisites: Network access to TCP port 5631 · List of usernames and passwords for brute-forcing
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by todb · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/postgres/postgres_login.rb

This Metasploit module is a PostgreSQL login utility that performs brute-force authentication against PostgreSQL instances using provided username and password combinations. It supports both plaintext and MD5-hashed passwords and can create interactive sessions upon successful login.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: PostgreSQL
No auth needed
Prerequisites: Network access to the PostgreSQL instance · Valid or guessable credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by todb, RageLtMan · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_login.rb

This Metasploit module is a credential scanner for SSH logins, testing both password and public key authentication methods. It reports successful logins and can create sessions for further exploitation.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: SSH servers (various versions)
Auth required
Prerequisites: Valid SSH credentials or private keys · Network access to target SSH port
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/nntp/nntp_login.rb

This Metasploit module is a credential brute-forcing utility for NNTP services supporting AUTHINFO USER/PASS authentication. It attempts to authenticate using provided username/password lists and reports successful logins.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: NNTP services supporting AUTHINFO USER/PASS
No auth needed
Prerequisites: Network access to NNTP service (port 119 by default) · Username and password wordlists
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ftp/ftp_login.rb

This is an FTP authentication scanner module from Metasploit that tests login credentials against FTP servers and reports successful logins. It includes brute-forcing capabilities and can record anonymous/guest logins if configured.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: FTP servers (various versions)
No auth needed
Prerequisites: Network access to target FTP server · List of usernames and passwords for brute-forcing
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/oracle/oracle_login.rb

This Metasploit module is a credential brute-forcing utility for Oracle RDBMS, leveraging Nmap's NSE script to test username/password combinations against a specified SID. It reports successful logins, locked accounts, and errors, but does not exploit a specific vulnerability.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Oracle RDBMS (various versions)
No auth needed
Prerequisites: Nmap (version 5.50 or later) · Network access to Oracle RDBMS · Valid SID for targeting
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC MANUAL
by Spencer McIntyre, Brandon Knight · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/ssh/sshexec.rb

This Metasploit module exploits weak SSH credentials (CVE-1999-0502) to execute arbitrary commands or payloads on a target system via SSH. It supports multiple architectures and platforms, including Linux, OSX, BSD, and Python-based payloads.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: SSH servers with weak credentials
Auth required
Prerequisites: Valid SSH credentials (username/password) · SSH service accessible on the target
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0502

Scores

EPSS 0.3709
EPSS Percentile 97.3%

Details

VulnCheck KEV 2016-11-11
Status published
Products (7)
hp/hp-ux 10.20
hp/hp-ux 11
redhat/linux 6.0
sun/solaris 2.6
sun/sunos 5.5.1
sun/sunos 5.7
sun/sunos 5.8
Published Mar 01, 1998
Tracked Since Feb 18, 2026