CVE-2009-3023: Microsoft IIS FTP Service buffer overflow via crafted NLST command

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with a high CVSS v2 score of 9.0 and very high EPSS, though exploitation requires valid FTP credentials and the affected IIS versions are legacy.

What it is

The FTP Service in Microsoft IIS 5.0 through 6.0 contains a classic buffer overflow (CWE-120) triggered by a crafted NLST command using wildcards, causing memory corruption. A remote authenticated user can exploit this to run arbitrary code on the FTP server, and the same flaw can cause denial of service.

Impact

An attacker with valid FTP credentials gains remote code execution in the context of the IIS FTP service, potentially full control of the host. The flaw can also crash the service, disrupting FTP availability.

Attack surface

Reachable over the network through the FTP service (AV:N, AC:L) with a crafted NLST command; the vector requires authentication (Au:S) and no user interaction. Only IIS 5.0 through 6.0 FTP Service is affected per the description.

Exploitation

Not listed in CISA KEV, but public exploit code exists (Exploit-DB 9541 and 9559, SecurityFocus BID 36189) and EPSS is very high at 0.909 (99.8th percentile), indicating elevated likelihood of exploitation.

What to do

• Apply Microsoft security bulletin MS09-053 (KB975191) to patch the IIS FTP Service.
• Disable or restrict the IIS FTP Service where it is not required.
• Limit FTP access to trusted accounts and networks, since exploitation requires authentication.
• Segment or firewall FTP endpoints to reduce exposure to untrusted networks.
• Monitor for and block malformed NLST commands containing wildcards at the FTP boundary where feasible.

Detection

• Review IIS FTP logs for NLST commands containing wildcard characters, especially unusual or repeated patterns.
• Alert on IIS FTP service crashes or unexpected worker process restarts.
• Monitor for anomalous child processes or command execution spawned by the FTP service account.
• Correlate FTP authentication events with subsequent suspicious process or network activity on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.