CVE-2001-1243: Microsoft IIS ASP Scripting.FileSystemObject device name denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable, unauthenticated, low-complexity denial of service with public exploit material and a very high EPSS score, though impact is limited to availability.

What it is

Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 crashes when an ASP program opens a file using an MS-DOS device name. The same crash can be triggered by injecting a device name into ASP programs that internally use Scripting.FileSystemObject. This lets an attacker take down the IIS worker process and interrupt hosted web applications.

Impact

An attacker can cause a denial of service by crashing IIS through a crafted ASP request or page. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

The CVSS vector is AV:N/AC:L/Au:N/C:N/I:N/A:P, so it is reachable over the network with no authentication and low complexity. The description also notes local attackers, and the remote path requires the ability to reach an ASP endpoint or inject a device name into one.

Exploitation

Not listed in CISA KEV. EPSS 30-day probability is 0.70505 (99.357th percentile), and references carry an Exploit tag, indicating public exploit material exists.

What to do

• Apply the Microsoft patch referenced by the vendor advisory and SecurityFocus BID 2973.
• Upgrade or retire IIS 4.0 and 5.0, which are long out of support.
• Restrict network access to ASP endpoints and filter MS-DOS device names (CON, AUX, COM1-9, LPT1-9, NUL, PRN) in request input.
• Review ASP code that passes user input to Scripting.FileSystemObject file operations and validate or reject device-name values.
• Run IIS worker processes under least privilege and isolate them so a crash does not affect other services.

Detection

• Monitor IIS and Windows event logs for repeated worker process crashes or ASP.dll faults.
• Alert on HTTP requests containing MS-DOS device names such as CON, AUX, NUL, PRN, COM1-9 or LPT1-9.
• Review ASP source and logs for Scripting.FileSystemObject calls that open files using user-supplied names.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.