CVE-2009-3023

EXPLOITED

Microsoft Internet Information Server 5.0-6.0 - Authenticated Remote Code Execution via FTP NLST Command Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2009-3023 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including Metasploit, muts, kingcope, including a Metasploit module exploits/windows/ftp/ms09_053_ftpd_nlst.

AI-analyzed exploit summary This exploit targets a stack buffer overflow in Microsoft IIS FTP Server via a malformed NLST command. It uses an egg hunter to locate shellcode stored on the stack, achieving remote code execution.

Description

Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka "IIS FTP Service RCE and DoS Vulnerability."

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16740

This exploit targets a stack buffer overflow in Microsoft IIS FTP Server via a malformed NLST command. It uses an egg hunter to locate shellcode stored on the stack, achieving remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft IIS FTP Server (IIS 5.0 on Windows 2000)
Auth required
Prerequisites: FTP server with write access · Valid credentials or anonymous write access
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by muts · perlremotewindows
https://www.exploit-db.com/exploits/9559

This exploit targets a buffer overflow vulnerability in IIS 5.0 FTP Server on Windows 2000 SP4. It uses a combination of shellcode, an egghunter, and a bind shell payload to achieve remote code execution as SYSTEM.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: IIS 5.0 FTP Server on Windows 2000 SP4
No auth needed
Prerequisites: Network access to the target FTP server · IIS 5.0 FTP Server running on Windows 2000 SP4
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by kingcope · perlremotewindows
https://www.exploit-db.com/exploits/9541

This exploit targets a buffer overflow vulnerability in IIS 5.0 FTPd on Windows 2000 SP4. It uses a crafted SITE command to overwrite the stack and execute shellcode, resulting in remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: IIS 5.0 FTPd on Windows 2000 SP4
No auth needed
Prerequisites: Network access to the target FTP server · IIS 5.0 FTPd running on Windows 2000 SP4
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GREAT
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/ms09_053_ftpd_nlst.rb

This exploit targets a stack buffer overflow in Microsoft IIS FTP Server (CVE-2009-3023) via a malformed NLST command. It uses an egg hunter to locate and execute shellcode stored on the stack, achieving remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft IIS FTP Server (IIS 5.0)
Auth required
Prerequisites: FTP server with write access · Target running vulnerable IIS version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Vendor Advisory vendor-advisory x_refsource_mskb
http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ975191
Exploit, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/36189
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9541
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-286A.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2481
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-053
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9559
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/276653

Scores

EPSS 0.7773
EPSS Percentile 99.0%

Details

VulnCheck KEV 2009-10-19
CWE
CWE-120
Status published
Products (1)
microsoft/internet_information_server 5.0 - 6.0
Published Aug 31, 2009
Tracked Since Feb 18, 2026