CVE-2006-6578

N/A Unknown

Published: December 15, 2006 Modified: April 23, 2026

Description

Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated using win.com when it is in a web directory with certain permissions.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://securityreason.com/securityalert/2036

Source: cve@mitre.org

Exploit Third Party Advisory

http://www.securityfocus.com/archive/1/454268/100/0/threaded

Source: cve@mitre.org

Exploit Third Party Advisory VDB Entry

http://securityreason.com/securityalert/2036

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory

http://www.securityfocus.com/archive/1/454268/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory VDB Entry

4 reference(s) from NVD

Quick Stats

CVSS v3 Score

N/A / 10.0

EPSS (Exploit Probability)

1.4%

81th percentile

Exploitation Status

Not in CISA KEV

Affected Vendors

microsoft