CVE-2002-2028: Microsoft Windows 2000

Low severity, CVSS 2.1. EPSS: 2% chance of exploitation in the next 30 days.

The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing.

Affected products

• Microsoft Windows 2000: any version
• Microsoft Windows Nt: version 4.0 only
• Microsoft Windows XP: any version

Published 2002-12-31. Last modified 2026-06-16.