CVE-2008-0075: Microsoft IIS ASP code injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication, and full confidentiality, integrity, and availability impact, combined with a very high EPSS percentile, makes this a top-priority patch despite the thin description.

What it is

CVE-2008-0075 is an unspecified code injection flaw in Microsoft Internet Information Services (IIS) 5.1 through 6.0 that is triggered by crafted inputs to ASP pages. Because the flaw is described only as unspecified, the exact mechanism is not documented in this record, but the impact is full remote code execution. It matters because IIS is a widely deployed web server and the flaw is reachable over the network without authentication.

Impact

A remote attacker can execute arbitrary code on the IIS server, gaining the privileges of the worker process and potentially full control of the host. This can lead to data theft, defacement, or use of the server as a pivot into the internal network.

Attack surface

The vector is AV:N/AC:L/Au:N, so the flaw is reachable over the network with no authentication and no user interaction. The description states the attack is delivered through crafted inputs to ASP pages, meaning any exposed IIS 5.1-6.0 server hosting ASP content is a candidate target.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit tags in its references, so there is no confirmed in-the-wild exploitation evidence here. EPSS is high at 0.57167 (99th percentile), indicating a strong statistical likelihood of exploitation activity, but that is a model estimate, not proof.

What to do

• Apply the Microsoft security update for MS08-006, which addresses this vulnerability, as the first action.
• If patching cannot be done immediately, disable or restrict ASP processing on IIS 5.1 and 6.0 servers that do not require it.
• Limit network exposure of IIS servers to trusted clients and place them behind a reverse proxy or WAF that can filter malformed ASP requests.
• Run IIS worker processes under a least-privilege account to reduce the impact of successful code execution.
• Monitor Microsoft and US-CERT advisories for updated guidance, since the original description is unspecified.

Detection

• Review IIS and Windows event logs for unexpected w3wp.exe process creation, crashes, or child processes spawned by the worker process.
• Monitor for anomalous HTTP requests to .asp endpoints, especially malformed or unusually long parameters, using web server access logs or a WAF.
• Alert on outbound network connections or file writes originating from w3wp.exe that are not consistent with normal application behavior.
• Check for unauthorized changes to ASP files or new executable files in IIS web directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.