The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
Not properly handling virtual filenames (e.g. AUX, CON, PRN, COM1, LPT1) can result in different types of vulnerabilities. In some cases an attacker can request a device via injection of a virtual filename in a URL, which may cause an error that leads to a denial of service or an error page that reveals sensitive information. A product that allows device names to bypass filtering runs the risk of an attacker injecting malicious code in a file with the name of a device.

Resultant

Historically, there was a bug in the Windows operating system that caused a blue screen of death. Even after that issue was fixed DOS device names continue to be a factor.

Implementation

Operation

High

Availability
Confidentiality
Other
DoS: Crash, Exit, or Restart
Read Application Data
Other

Implementation
Be familiar with the device names in the operating system where your system is deployed. Check input for these device names.

CVE-2002-0106
Server allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name.
https://www.cve.org/CVERecord?id=CVE-2002-0106

CVE-2002-0200
Server allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name.
https://www.cve.org/CVERecord?id=CVE-2002-0200

CVE-2002-1052
Product allows remote attackers to use MS-DOS device names in HTTP requests to cause a denial of service or obtain the physical path of the server.
https://www.cve.org/CVERecord?id=CVE-2002-1052

CVE-2001-0493
Server allows remote attackers to cause a denial of service via a URL that contains an MS-DOS device name.
https://www.cve.org/CVERecord?id=CVE-2001-0493

CVE-2001-0558
Server allows a remote attacker to create a denial of service via a URL request which includes a MS-DOS device name.
https://www.cve.org/CVERecord?id=CVE-2001-0558

CVE-2000-0168
Microsoft Windows 9x operating systems allow an attacker to cause a denial of service via a pathname that includes file device names, aka the "DOS Device in Path Name" vulnerability.
https://www.cve.org/CVERecord?id=CVE-2000-0168

CVE-2001-0492
Server allows remote attackers to determine the physical path of the server via a URL containing MS-DOS device names.
https://www.cve.org/CVERecord?id=CVE-2001-0492

CVE-2004-0552
Product does not properly handle files whose names contain reserved MS-DOS device names, which can allow malicious code to bypass detection when it is installed, copied, or executed.
https://www.cve.org/CVERecord?id=CVE-2004-0552

CVE-2005-2195
Server allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an MS-DOS device name.
https://www.cve.org/CVERecord?id=CVE-2005-2195

File Processing

File or Directory

Windows MS-DOS device names

FIO32-C
Do not perform operations on devices that are only appropriate for files
CWE More Specific

FIO00-J
Do not operate on files in shared directories

SFP16
Path Traversal

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2008-10-14
updated Description

CWE Content Team
MITRE
2008-11-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Description, Name

CWE Content Team
MITRE
2009-10-29
updated Background_Details, Other_Notes

CWE Content Team
MITRE
2010-09-27
updated Description

CWE Content Team
MITRE
2011-03-29
updated Description

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-09-13
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples, References, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Affected_Resources, Applicable_Platforms, Causal_Nature, Likelihood_of_Exploit, References, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2018-03-27
updated References

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Functional_Areas

Windows MS-DOS Device Names
Failure to Handle Windows Device Names