CVE-2006-6578: microsoft internet_information_services
Vulnerability summary
CVE-2006-6578 is a high (CVSS 7.5) vulnerability in microsoft internet_information_services. EPSS estimates a 7.04% chance of exploitation in the next 30 days, higher than 94.1% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 15-12-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated using win.com when it is in a web directory with certain permissions.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
7.04%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.04% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (securityreason.com)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft1 product
1 vendor · 1 product
References
2 links- www.securityfocus.com/archive/1/454268/100/0/threadedMailing ListX Refsource BUGTRAQExploitThird Party AdvisoryVDB Entry