CVE-2002-0421: Microsoft Windows Nt

Medium severity, CVSS 5.0. EPSS: 20% chance of exploitation in the next 30 days.

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.

Affected products

• Microsoft Windows Nt: version 4.0 only

Published 2002-08-12. Last modified 2026-06-16.