CVE-2002-0421

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 20.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-06-11 · updated 2026-06-16

Description

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.

Affected products

Microsoft Windows Nt: 4.0, 4.0-sp1, 4.0-sp2, 4.0-sp3, 4.0-sp4, 4.0-sp5 (+2)

References

http://online.securityfocus.com/archive/1/259963
http://www.iss.net/security_center/static/8388.php
http://www.securityfocus.com/bid/4236
http://online.securityfocus.com/archive/1/259963
http://www.iss.net/security_center/static/8388.php
http://www.securityfocus.com/bid/4236

Get alerted when CVE-2002-0421 or the next vulnerability affects your stack