{"id":"CVE-2017-7269","published":"2017-03-27T02:59:00Z","modified":"2026-06-17T01:23:58Z","title":"Microsoft Windows Server Buffer Overflow Vulnerability","vendor":"Microsoft","product":"Internet Information Services (IIS)","tier":"core","eol":null,"description":{"text":"Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with \"If: <http://\" in a PROPFIND request, as exploited in the wild in July or August 2016.","provenance":"source","from":"NVD"},"summary":{"text":"A buffer overflow in the ScStoragePathFromUrl function of the WebDAV service in Microsoft Internet Information Services (IIS) 6.0 on Windows Server 2003 R2 is the flaw. An unauthenticated remote attacker can execute arbitrary code by sending a PROPFIND request containing a long \"If: <http://\" header, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:42Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99823,"percentile":0.99959,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-7269","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-03-27","exploitedFirstSeen":"2017-03-27","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7269","date":"2017-03-27"},{"url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments","date":"2017-06-20"},{"url":"https://documents.trendmicro.com/assets/appendix-following-the-trail-of-blacktechs-cyber-espionage-campaigns.pdf","date":"2017-06-22"},{"url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","date":"2017-06-22"},{"url":"https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/","date":"2021-05-06"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent","date":"2026-07-23"},{"url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape","date":"2026-08-07"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://www.securityfocus.com/bid/97127","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038168","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/danigargu/explodingcan","tags":["Exploit"]},{"url":"https://github.com/edwardz246003/IIS_exploit","tags":["Broken Link","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/8162","tags":["Issue Tracking","Patch"]},{"url":"https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812","tags":["Exploit"]},{"url":"https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/41738/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41992/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/97127","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038168","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/danigargu/explodingcan","tags":["Exploit"]},{"url":"https://github.com/edwardz246003/IIS_exploit","tags":["Broken Link","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/8162","tags":["Issue Tracking","Patch"]},{"url":"https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812","tags":["Exploit"]},{"url":"https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/41738/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41992/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote network exploitation of public-facing IIS service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via a long header","start":154,"end":221}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution is the direct impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":154,"end":203}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-92352da397787b4045e8","title":"The Trail of BlackTech’s Cyber Espionage Campaigns","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","date":"2017-06-22","mentions":[{"quote":"PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server.","start":2734,"end":2881}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-16299","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-16299","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":41738,"url":"https://www.exploit-db.com/exploits/41738","title":"Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow","type":"remote","platform":"windows","date":"2017-03-27","verified":false,"provenance":"source"},{"id":41992,"url":"https://www.exploit-db.com/exploits/41992","title":"Microsoft IIS - WebDav 'ScStoragePathFromUrl' Remote Overflow (Metasploit)","type":"remote","platform":"windows","date":"2017-05-11","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-03-27"},"pocGithub":{"count":14,"skipped":5,"earliest":"2017-03-29","earliestUrl":"https://github.com/eliuha/webdav_exploit","repos":[{"name":"zcgonvh/cve-2017-7269","url":"https://github.com/zcgonvh/cve-2017-7269","stars":135,"created":"2017-03-30"},{"name":"g0rx/iis6-exploit-2017-CVE-2017-7269","url":"https://github.com/g0rx/iis6-exploit-2017-CVE-2017-7269","stars":92,"created":"2017-04-05"},{"name":"lcatro/CVE-2017-7269-Echo-PoC","url":"https://github.com/lcatro/CVE-2017-7269-Echo-PoC","stars":89,"created":"2017-03-29"},{"name":"zcgonvh/cve-2017-7269-tool","url":"https://github.com/zcgonvh/cve-2017-7269-tool","stars":88,"created":"2017-05-16"},{"name":"eliuha/webdav_exploit","url":"https://github.com/eliuha/webdav_exploit","stars":22,"created":"2017-03-29"}]},"metasploit":[{"name":"Microsoft IIS WebDav ScStoragePathFromUrl Overflow","module":"exploit/windows/iis/iis_webdav_scstoragepathfromurl","type":"exploit","disclosureDate":"2017-03-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb"}],"nuclei":[{"id":"CVE-2017-7269","name":"Windows Server 2003 & IIS 6.0 - Remote Code Execution","severity":"critical","path":"http/cves/2017/CVE-2017-7269.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7269.yaml"}],"first":{"date":"2017-03-26","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb"},"provenance":"source"},"exploitRefs":["https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html","https://github.com/danigargu/explodingcan","https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812","https://www.exploit-db.com/exploits/41738/","https://www.exploit-db.com/exploits/41992/","https://github.com/edwardz246003/IIS_exploit"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2017-03-26","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2017-03-27, PoC-in-GitHub 2017-03-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb","provenance":"source"},{"date":"2017-03-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7269","provenance":"source"},{"date":"2017-03-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2017-7269","provenance":"source"},{"date":"2017-06-22","kind":"report","label":"Named in trendmicro.com: The Trail of BlackTech’s Cyber Espionage Campaigns","url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-16299","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1682},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3503 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"5 NVD references tagged Exploit; 2 Exploit-DB entries; 1 NVD exploit link; 14 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}