CVE-2000-1209
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2)...
CVE-2000-1209 is a high vulnerability (CVSS 10.0) in Compaq Insight Manager, published August 10, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 87.3%, the 99th percentile. No source names a fixed version.
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.
Exploit likelihood
What each source reports
NVD Score used
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.
- Record
CVE-2000-1209- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.
- Record
CVE-2000-1209- Updated
- 2026-11-02
EUVDEUVD-2000-1194 No score
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.
- Record
EUVD-2000-1194- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hwwv-vx36-7jpp No score
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2)...
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.
- Record
GHSA-hwwv-vx36-7jpp- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft SQL Server - Payload Execution (via SQL Injection) (Metasploit) | 2011-02-08 |
| Exploit-DB | Microsoft SQL Server - Payload Execution (Metasploit) | 2010-12-21 |
| Metasploit | Microsoft SQL Server Payload Execution | 2000-05-30 |
| Metasploit | Microsoft SQL Server Payload Execution via SQL Injection | 2000-05-30 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
References
osvdb.org/3570
securityfocus.com/bid/4797
marc.info?l=bugtraq&m=96333895000350&w=2
kb.cert.org/vuls/id/635463
iss.net/security_center/static/1459.php
microsoft.com/security/security_bulletins/ms02020_sql.asp
Show 10 moreShow less
online.securityfocus.com/archive/1/273639
support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ313418
security-archive.merton.ox.ac.uk/bugtraq-200008/0233.html
nvd.nist.gov/vuln/detail/CVE-2000-1209
github.com/advisories/GHSA-hwwv-vx36-7jpp