CVE-2002-1744: Microsoft IIS CodeBrws.asp directory traversal via Unicode encoding

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe flaw only exposes file contents and existence (partial confidentiality, CVSS 5.0), but public exploit material and a very high EPSS score raise the likelihood of scanning and abuse.

What it is

CodeBrws.asp in Microsoft IIS 5.0 is vulnerable to directory traversal using a hex-encoded Unicode string (%c0%ae%c0%ae) that decodes to "..", letting a remote attacker escape the intended directory. It matters because it exposes source code and lets an attacker confirm the existence of arbitrary files on the server.

Impact

An attacker gains read access to source code and can determine whether arbitrary files exist on the host. The CVSS vector limits this to partial confidentiality impact with no integrity or availability effect.

Attack surface

Reachable over the network through HTTP requests to CodeBrws.asp; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.65174 (99.2nd percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.

What to do

• Apply the Microsoft patch or upgrade from IIS 5.0 to a supported version, since this is a legacy product.
• Remove or disable CodeBrws.asp and other IIS sample/script files not required in production.
• Restrict access to IIS sample directories via web server configuration and file permissions.
• Filter or reject requests containing encoded traversal sequences such as %c0%ae in a reverse proxy or WAF.

Detection

• Search web logs for requests to CodeBrws.asp containing %c0%ae or similar encoded traversal strings.
• Alert on CodeBrws.asp requests returning 200 responses for paths outside the expected web root.
• Monitor for repeated file-existence probing patterns against IIS sample scripts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.