CVE-2007-2897
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of...
CVE-2007-2897 is a high vulnerability (CVSS 7.5) in Microsoft Internet Information Server, published May 30, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 74.0%, the 99th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 74.0%EPSS, 99th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests.
Exploit likelihood
Affected products
What each source reports
NVD Score used
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests.
- Record
CVE-2007-2897- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests.
- Record
CVE-2007-2897- Updated
- 2026-11-02
EUVDEUVD-2007-2889No score
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests.
- Record
EUVD-2007-2889- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-235j-w393-fq4fNo score
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of...
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests.
- Record
GHSA-235j-w393-fq4f- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.