CVE-1999-0407

CVE-1999-0407 describes a critical vulnerability in Microsoft IIS 4.0, where the default /IISADMPWD virtual directory exposes files that can be leveraged for brute-force password attacks or to enumerate valid user accounts. This vulnerability carries a maximum CVSS score of 10.0, indicating a severe risk due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. Despite its high severity and EPSS score, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage.