What’s Vulnerable › Vulnerabilities
CVE-2002-2028
- Severity: low (CVSS 2.1 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2002-12-31 · updated 2026-06-16
Description
The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing.
Affected products
- Microsoft Windows 2000: all versions
- Microsoft Windows Nt: 4.0, 4.0-sp1, 4.0-sp2, 4.0-sp3, 4.0-sp4, 4.0-sp5 (+1)
- Microsoft Windows XP Service Pack 3: all versions
References
- http://cert.uni-stuttgart.de/archive/bugtraq/2002/01/msg00278.html
- http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq188700
- http://www.heysoft.de/nt/lbh.htm
- http://www.securityfocus.com/bid/3933
- http://cert.uni-stuttgart.de/archive/bugtraq/2002/01/msg00278.html
- http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq188700
- http://www.heysoft.de/nt/lbh.htm
- http://www.securityfocus.com/bid/3933
Get alerted when CVE-2002-2028 or the next vulnerability affects your stack