CVE-2000-0649: IIS 4.0 basic auth realm flaw leaks internal IP address

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

low priorityThe flaw only discloses an internal IP address, requires a specific HTTP 1.0 and no-realm configuration, and carries a CVSS 2.0 score of 2.6 despite high EPSS and public exploit references.

What it is

IIS 4.0 returns the server's internal IP address when an HTTP 1.0 request is made for a page protected by basic authentication that has no realm defined. The leak exposes internal network addressing that would otherwise be hidden behind the web server, which aids reconnaissance and follow-on targeting.

Impact

An attacker gains the internal IP address of the IIS server, information useful for mapping internal networks and planning further attacks. No data modification or code execution is possible from this flaw alone.

Attack surface

Reachable remotely over the network via a crafted HTTP 1.0 request to a basic-authentication-protected page with no realm; no authentication is required because the leak occurs in the authentication challenge itself, and no user interaction is needed.

Exploitation

No CISA KEV listing and no ransomware association; the references are tagged Exploit, Patch and Vendor Advisory, indicating public exploit detail exists, and EPSS is high at 0.766 (99.5th percentile), though the CVSS 2.0 score is only 2.6.

What to do

• Apply the vendor patch referenced in the Microsoft advisory and NTBugtraq posting; upgrade off IIS 4.0, which is long end-of-life.
• Define an explicit realm on every basic-authentication-protected directory so the challenge does not fall back to leaking internal addressing.
• Restrict or disable HTTP 1.0 where feasible and require HTTP 1.1 or later for protected resources.
• Place affected servers behind a reverse proxy or firewall that normalizes authentication challenges and blocks direct external access.

Detection

• Search web server logs for HTTP 1.0 requests to basic-auth-protected paths that return 401 challenges, especially repeated probes from the same source.
• Inspect 401 response headers for authentication challenges that disclose internal IP addresses or lack a realm value.
• Monitor for scanning activity against protected directories from external IPs as an indicator of reconnaissance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.