Vulnerability record · CVE-2007-2897 · published 30 May 2007
CVE-2007-2897: IIS 6.0 DOS device URI bypass causes denial of service
Microsoft · Internet Information Server
Microsoft IIS 6.0 mishandles requests for URIs that place a '/' before and after a DOS device name, such as /AUX/.aspx, bypassing the blacklist for DOS device requests. This can destabilize or hang the server and may expose device communication traffic. The record is old and thin, with no vendor advisory or affected-version detail beyond IIS 6.0.
Description
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote denial of service with a high EPSS score, though the record lacks vendor confirmation and exploit detail.
What it is
Microsoft IIS 6.0 mishandles requests for URIs that place a '/' before and after a DOS device name, such as /AUX/.aspx, bypassing the blacklist for DOS device requests. This can destabilize or hang the server and may expose device communication traffic. The record is old and thin, with no vendor advisory or affected-version detail beyond IIS 6.0.
Impact
An unauthenticated remote attacker can cause server instability or a device hang, and possibly read sensitive device communication traffic. The description also speculates about arbitrary code execution, but only for attackers with physical access to a COM port, which is not a remote gain.
Attack surface
Reached over the network via HTTP by requesting a crafted URI containing a DOS device name wrapped in slashes. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.
Exploitation
Not listed in CISA KEV and no reference is tagged as exploit code, though EPSS is high at 0.74 (99.5th percentile), indicating elevated predicted exploitation likelihood. No public exploit confirmation is present in the record.
What to do
- Apply the Microsoft fix or supported IIS update for the DOS device request handling flaw; if no patch exists for this legacy version, migrate off IIS 6.0.
- Block or normalize request URIs containing DOS device names (AUX, CON, PRN, NUL, COM1-9, LPT1-9) at the web server or reverse proxy.
- Restrict network exposure of IIS 6.0 hosts and place them behind a filtering proxy or WAF.
- Limit physical and COM port access on hosts running IIS 6.0 to trusted personnel.
- Monitor IIS logs for repeated requests matching the /DEVICE/.ext pattern and rate-limit offending sources.
Detection
- Search IIS or proxy logs for URIs matching /(AUX|CON|PRN|NUL|COM[1-9]|LPT[1-9])/ with any extension.
- Alert on spikes in 4xx/5xx responses or server restarts correlated with such URI requests.
- Monitor host stability events (hangs, unexpected reboots) on IIS 6.0 systems alongside unusual HTTP request patterns.
- Watch for repeated requests from a single source to device-name URIs as a possible DoS attempt.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-2897 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-2897), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
