CVE-2001-1243

Microsoft Internet Information Server - Denial of Service via MS-DOS Device Name Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2001-1243. PoCs published by VIPER_SV.

AI-analyzed exploit summary This is a writeup describing a DoS vulnerability in Microsoft IIS where a crafted URL with a device name as a script parameter causes the server to crash. No actual exploit code is provided, only a description and example URL.

Description

Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.

Exploits (2)

exploitdb WRITEUP VERIFIED
by VIPER_SV · textdoswindows
https://www.exploit-db.com/exploits/20991

This is a writeup describing a DoS vulnerability in Microsoft IIS where a crafted URL with a device name as a script parameter causes the server to crash. No actual exploit code is provided, only a description and example URL.

Classification
Writeup 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS
No auth needed
Prerequisites: Network access to the target IIS server
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by VIPER_SV · textdoswindows
https://www.exploit-db.com/exploits/20989

This exploit is a simple ASP script that triggers a denial of service (DoS) in Microsoft IIS by attempting to open and read from a device file (e.g., 'com1'). The vulnerability arises due to improper handling of device file access, causing the server to crash.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS (versions affected by CVE-2001-1243)
Auth required
Prerequisites: Ability to create or upload an ASP file on the target IIS server · Local or remote file write access to the web directory
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Vendor Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/6800.php
Exploit, Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/2973
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/194919

Scores

EPSS 0.6319
EPSS Percentile 99.1%

Details

Status published
Products (2)
microsoft/internet_information_server 4.0
microsoft/internet_information_services 5.0
Published Jul 04, 2001
Tracked Since Feb 18, 2026