CVE-2015-0015: Windows IAS/NPS RADIUS crafted username denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote denial of service against core authentication infrastructure with a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Microsoft Windows Server 2003 SP2, Server 2008 SP2/R2 SP1, and Server 2012 Gold/R2 fail to properly handle crafted username strings in the Internet Authentication Service (IAS) and Network Policy Server (NPS) RADIUS implementation. A remote unauthenticated attacker can send such a string and hang the system, causing a RADIUS outage. The flaw is a resource-handling issue (CWE-399) affecting authentication infrastructure.

Impact

An attacker can hang the affected server and take down RADIUS authentication, denying access to all services that rely on it. There is no confidentiality or integrity impact; the effect is a full availability loss on the authentication path.

Attack surface

Reachable over the network via RADIUS traffic to IAS or NPS; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host able to send RADIUS requests to the server can attempt it.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is very high (0.787, 99.6th percentile), indicating elevated predicted exploitation activity. No public exploit details are provided in this record.

What to do

• Apply Microsoft security bulletin MS15-007 for the affected Windows Server versions.
• Restrict RADIUS traffic to trusted network segments and known client IPs using firewall rules.
• Where feasible, retire or isolate unsupported Windows Server 2003/2008/2012 systems running IAS or NPS.
• Monitor and rate-limit RADIUS request rates to reduce the chance of a single client hanging the service.
• Maintain redundant RADIUS servers so one hung instance does not cause a full authentication outage.

Detection

• Alert on RADIUS service unresponsiveness or unexpected IAS/NPS process hangs on servers.
• Monitor for a spike in malformed or unusually long username strings in RADIUS authentication logs.
• Track RADIUS request volume per source IP and flag sources sending abnormal volumes or malformed attributes.
• Watch for sudden authentication failures across dependent services that coincide with RADIUS server unavailability.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.