CVE-2009-2521: Microsoft IIS FTP Service stack consumption denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw only causes a denial of service and requires authenticated FTP access, but the affected IIS versions are legacy and EPSS is very high.

What it is

The FTP Service in Microsoft IIS 5.0 through 7.0 mishandles a recursive list (ls -R) command containing a wildcard that references a subdirectory followed by a dot-dot sequence, exhausting the stack. A remote authenticated FTP user can crash the daemon, taking the FTP service offline. The record gives no affected version detail beyond the IIS 5.0-7.0 range and no CVSS v3 score.

Impact

An attacker with valid FTP credentials can cause a denial of service by crashing the IIS FTP daemon, interrupting FTP availability for all users on that host. There is no confidentiality or integrity impact; the CVSS v2 vector rates availability impact as partial.

Attack surface

Reached over the network through the FTP service (AV:N, AC:L) by a remote authenticated user; the description states authentication is required, and no user interaction is indicated. The trigger is a crafted ls -R command with a wildcard subdirectory reference followed by dot-dot.

Exploitation

Not listed in CISA KEV and no ransomware use is documented; EPSS is high (0.82265, 99.6th percentile), and references include a vendor patch bulletin (MS09-053) plus US-CERT and OVAL advisories, but no public exploit tag is present in the record.

What to do

• Apply Microsoft security bulletin MS09-053 (KB975191) to affected IIS FTP installations.
• Restrict FTP access to trusted accounts and disable or block anonymous FTP where not required.
• Limit FTP directory listing recursion and monitor for repeated ls -R commands with wildcard and dot-dot patterns.
• If the FTP service is not needed, disable it or migrate off IIS 5.0-7.0 FTP to a supported platform.

Detection

• Alert on FTP commands containing 'ls -R' combined with wildcard characters and '..' sequences in server or FTP logs.
• Monitor for unexpected IIS FTP service crashes or restarts in Windows event logs.
• Baseline and watch for spikes in recursive directory listing commands from a single authenticated FTP account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.