CVE-2001-1122

Windows NT 4.0 SP 6a - Denial of Service via NT4ALL Exploit in SPECIAL Mode

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2001-1122. PoCs published by hypoclear.

AI-analyzed exploit summary The exploit describes a local denial of service (DoS) vulnerability in Windows NT systems using the 'NT4ALL' tool, which requires write permissions to the C:\winnt\system32\ directory. The vulnerability is triggered by rebooting the system while it is in 'special mode' set by NT4ALL.

Description

Windows NT 4.0 SP 6a allows a local user with write access to winnt/system32 to cause a denial of service (crash in lsass.exe) by running the NT4ALL exploit program in 'SPECIAL' mode.

Exploits (1)

exploitdb WRITEUP VERIFIED
by hypoclear · textdoswindows
https://www.exploit-db.com/exploits/21047

The exploit describes a local denial of service (DoS) vulnerability in Windows NT systems using the 'NT4ALL' tool, which requires write permissions to the C:\winnt\system32\ directory. The vulnerability is triggered by rebooting the system while it is in 'special mode' set by NT4ALL.

Classification
Writeup 80%
Attack Type
Dos
Complexity
Moderate
Reliability
Theoretical
Target: Windows NT
Auth required
Prerequisites: Local user access · Write permissions to C:\winnt\system32\ directory
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/3144
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/6943
Exploit, Patch, Vendor Advisory mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/201722

Scores

EPSS 0.0352
EPSS Percentile 87.8%

Details

Status published
Products (1)
microsoft/windows_nt 4.0 (8 CPE variants)
Published Aug 03, 2001
Tracked Since Feb 18, 2026