'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_srv:iis_basic_auth（Rule ID：1070010002）

Release Date：2025/9/15

Rule Name：CVE-2010-2731: Microsoft IIS Directory Authentication Security Bypass

Severity：mid

CVE ID：CVE-2010-2731

 

Descripiton：

Internet Information Services (IIS) is an extensible Web server created by Microsoft. IIS is a Web service components, including Web server, FTP server, NNTP server and SMTP server, respectly used for Web browsing, file transfer, news services and email, etc.. IIS makes it convenient for users to publish information on network. Unspecified vulnerability in IIS 5.1 on Windows XP SP3, when directory-based Basic Authentication is enabled, allows remote attackers to bypass intended access restrictions and execute ASP files via a crafted request. This rule supports to defend the A6: Vulnerable and Outdated Components and A7: Identification and Authentication Failures of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.