CVE-2017-7269criticalunder attackCWE-120

CVE-2017-7269

Published 27 Mar 2017 · Updated 21 Oct 2025

Follow this CVE + Monitor Internet Information Services

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%

from disclosure to weaponsame day

Published on NVDMar 27

1st PoCMar 27

metasploitMar 26

CISA KEV+1682d

Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateBlackTech🇨🇳 MITRE ATT&CK

Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A buffer overflow vulnerability in IIS 6.0's WebDAV service allows attackers to crash the server or run malicious code by sending a specially crafted request with an extremely long header. This is a critical flaw because it can be exploited remotely without authentication.

Technical detail

The ScStoragePathFromUrl function in IIS 6.0 WebDAV fails to properly validate header length in PROPFIND requests starting with 'If: <http://', causing a stack-based buffer overflow. Remote attackers can achieve arbitrary code execution with SYSTEM privileges; exploitation requires network access but no authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 45✓ VexDay Proof

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html https://github.com/danigargu/explodingcan https://github.com/edwardz246003/IIS_exploit https://github.com/rapid7/metasploit-framework/pull/8162 https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812 https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269 https://www.exploit-db.com/exploits/41738/https://www.exploit-db.com/exploits/41992/http://www.securityfocus.com/bid/97127 http://www.securitytracker.com/id/1038168