CVE-1999-1370 is a high-severity vulnerability affecting the setup wizard (ie5setup.exe) for Microsoft Internet Explorer version 5.0. The vulnerability arises because the setup process disables two critical system features: the screen saver and the Task Scheduler Service. Disabling the screen saver can leave a system vulnerable to unauthorized physical access if the installation process fails or is left unattended, as the screen saver often includes password protection to lock the system. Without this protection, an attacker with physical access could gain entry to the system. Additionally, disabling the Task Scheduler Service can prevent the execution of scheduled security-critical tasks such as automated virus scans, system updates, or other maintenance routines that rely on scheduled execution. This could degrade the overall security posture of the affected system by delaying or preventing important security operations. The vulnerability does not require network access to exploit (attack vector: local), requires low attack complexity, and no authentication, but it does require physical or local access to the machine. The impact on confidentiality, integrity, and availability is rated as complete compromise (C:C/I:C/A:C) because an attacker with physical access could gain full control, and security-critical tasks may not run as intended. There is no patch available for this vulnerability, and no known exploits have been reported in the wild. Given the age of the affected software (Internet Explorer 5.0), this vulnerability is largely of historical interest but could still pose risks in legacy environments.

For European organizations, the primary impact of this vulnerability is on legacy systems still running Internet Explorer 5.0, which may exist in industrial control systems, embedded devices, or isolated legacy environments. Physical security risks are heightened because disabling the screen saver removes a layer of protection against unauthorized physical access. This could lead to data breaches, unauthorized system changes, or disruption of operations. The disabling of the Task Scheduler Service could cause failure of automated security tasks, increasing the risk of malware persistence or delayed patching. While modern systems are not affected, organizations with legacy infrastructure in sectors such as manufacturing, utilities, or government may face increased risk. The vulnerability could also complicate compliance with European data protection regulations if unauthorized access leads to data exposure.

Given that no patch is available, organizations should focus on compensating controls. First, ensure strict physical security controls around any systems running Internet Explorer 5.0 to prevent unauthorized access. Use BIOS or firmware passwords and disable booting from external media to reduce risk. Where possible, upgrade or replace legacy systems to supported software versions. If upgrading is not feasible, implement network segmentation to isolate vulnerable systems and monitor them closely for suspicious activity. Re-enable or manually configure screen saver settings and Task Scheduler Service post-installation if possible. Additionally, enforce strict access control policies and consider using endpoint protection solutions that do not rely on the Task Scheduler. Regular audits of legacy systems should be conducted to verify security configurations and detect any unauthorized changes.