Vulnerability record · CVE-2003-0822 · published 15 December 2003
CVE-2003-0822: Microsoft FrontPage Server Extensions debug buffer overflow
Microsoft · Frontpage Server Extensions
A buffer overflow exists in the debug functionality of fp30reg.dll in Microsoft FrontPage Server Extensions 2000 and 2002. A remote attacker can trigger it with a crafted chunked-encoded request, which can lead to arbitrary code execution on the server. The affected component is legacy and no longer supported, but any internet-facing FPSE host remains exposed.
Description
Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution with a very high EPSS score, though the affected legacy software limits current real-world exposure.
What it is
A buffer overflow exists in the debug functionality of fp30reg.dll in Microsoft FrontPage Server Extensions 2000 and 2002. A remote attacker can trigger it with a crafted chunked-encoded request, which can lead to arbitrary code execution on the server. The affected component is legacy and no longer supported, but any internet-facing FPSE host remains exposed.
Impact
An unauthenticated remote attacker can execute arbitrary code in the context of the web server process, potentially taking full control of the host. This can lead to data theft, defacement, or use of the server as a pivot point.
Attack surface
Reached over the network via HTTP requests to the FPSE debug functionality in fp30reg.dll. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.81262, 99.6th percentile), indicating a strong likelihood of exploitation activity. Reference tags provide no explicit exploit-availability signal.
What to do
- Apply Microsoft security bulletin MS03-051 or the corresponding vendor update for FPSE 2000/2002.
- If the affected FPSE component cannot be patched, remove or disable FrontPage Server Extensions and the fp30reg.dll debug functionality.
- Block or filter chunked-encoded requests to FPSE endpoints at the web server or WAF where feasible.
- Retire unsupported Windows 2000/XP and FPSE 2000/2002 systems from production and internet exposure.
- Restrict network access to FPSE services to trusted management networks only.
Detection
- Monitor web server logs for requests to fp30reg.dll or FPSE debug paths, especially with chunked Transfer-Encoding.
- Alert on anomalous chunked-encoded POST requests or malformed chunk sizes targeting FPSE endpoints.
- Watch for unexpected child processes or command execution spawned by the web server process (w3wp.dllhost/inetinfo).
- Use the OVAL definitions referenced in the advisory to scan for vulnerable FPSE installations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0822 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0822), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
