Microsoft Windows IIS Default Index Page

Tenable plugin 106609 fires when an IIS site serves the stock default page at the web root. In practice, the affected range is not a software version range but a deployment condition: any Windows host running Microsoft IIS where the default document list still resolves to a stock file such as Iisstart.htm, Default.htm, Default.asp, Index.htm, Index.html, or Default.aspx and that content is still the IIS welcome page. Microsoft documents that default documents are enabled by default in IIS, so this is fundamentally a hardening/configuration issue, not a vendor patchable product flaw.

Tenable scoring this as MEDIUM overstates the operational risk for enterprise patch triage. The page can help an attacker fingerprint IIS and spot an unfinished deployment, but by itself it does not provide code execution, auth bypass, privilege escalation, or meaningful data exposure; it mainly shortens reconnaissance that other signals like headers, TLS fingerprints, and normal content often already provide.

Why this verdict

• Baseline starts too high Tenable's 5.3 assumes anonymous network-readable information disclosure, but the leaked value is usually just IIS fingerprinting and a hint of unfinished hardening.
• Requires a second failure to matter There is no direct path from this page to code execution, privilege gain, auth bypass, or material data loss; an attacker still needs another bug, weak app, or exposed admin path.
• Attacker position often implies prior access If the IIS host is internal-only, the prerequisite is internal network reachability, which means the finding becomes post-initial-access recon rather than a front-door risk.
• Reachable population is narrower than CVSS suggests Many enterprise IIS nodes are management, middleware, or intranet services not broadly internet-exposed, sharply reducing attacker opportunity.
• Modern controls should catch the meaningful stage, not this breadcrumb WAF, EDR, reverse proxies, and web logging are more likely to disrupt the exploit chain at the follow-on enumeration or attack stage.

Why not higher?

There is no standalone exploit chain here. Even for internet-facing hosts, the welcome page usually adds only weak fingerprinting value that attackers can often derive from headers, TLS, or application behavior; the real risk sits in whatever *other* issue they find next.

Why not lower?

It is still a real hardening lapse, especially on public-facing IIS where the stock page can advertise platform choice and signal sloppy deployment practices. At scale, forgotten default sites and placeholder pages are also useful indicators for broader configuration drift, so this should remain in backlog hygiene rather than be universally discarded.

1. Replace the stock page — Swap the IIS welcome page for the intended application landing page or a generic maintenance page so / no longer fingerprints the server. For a LOW verdict there is no formal mitigation SLA; handle this as backlog hygiene during normal web hardening.
2. Disable unused default sites and bindings — If Default Web Site exists only because IIS was installed, stop or remove it and clean up stray bindings that expose placeholder content. This reduces accidental exposure and prevents the welcome page from being reachable on alternate hostnames or IP bindings; schedule as backlog hygiene.
3. Scope and suppress intentionally benign cases — If an internal-only placeholder site is intentionally retained, document the business reason and reclassify or suppress the finding in Tenable so patch queues are not polluted. Do this after confirming the site is not internet-exposed and does not leak extra version or environment details.
4. Review adjacent IIS hardening — Use this finding as a trigger to verify directory browsing, sample applications, verbose errors, unnecessary modules, and admin paths are not exposed. The welcome page itself is weak, but it is a good drift signal for nearby hardening misses; clean those up in the same maintenance cycle.

Run this on the IIS host itself in an elevated PowerShell session. Invoke it as powershell -ExecutionPolicy Bypass -File .\check-iis-default-page.ps1 or save it and run locally; it needs rights to read IIS configuration and web root files via the WebAdministration module.

# check-iis-default-page.ps1

# Exit codes:

#   0 = PATCHED

#   1 = VULNERABLE

#   2 = UNKNOWN


$ErrorActionPreference = 'Stop'

function Write-Result {
    param(
        [string]$State,
        [int]$Code,
        [string]$Message
    )
    Write-Output "$State - $Message"
    exit $Code
}

try {
    Import-Module WebAdministration -ErrorAction Stop
} catch {
    Write-Result -State 'UNKNOWN' -Code 2 -Message 'WebAdministration module not available; cannot inspect IIS configuration.'
}

$stockNames = @('iisstart.htm','default.htm','default.asp','index.htm','index.html','default.aspx')
$stockMarkers = @(
    'IIS Windows Server',
    'Internet Information Services',
    'Welcome',
    'iisstart.png'
)

try {
    $sites = Get-Website | Where-Object { $_.State -eq 'Started' }
} catch {
    Write-Result -State 'UNKNOWN' -Code 2 -Message 'Unable to enumerate IIS sites.'
}

if (-not $sites -or $sites.Count -eq 0) {
    Write-Result -State 'PATCHED' -Code 0 -Message 'No started IIS websites found.'
}

$findings = New-Object System.Collections.Generic.List[string]

foreach ($site in $sites) {
    try {
        $sitePath = $site.PhysicalPath
        if ([string]::IsNullOrWhiteSpace($sitePath)) { continue }

        $expandedPath = [Environment]::ExpandEnvironmentVariables($sitePath)
        if (-not (Test-Path -LiteralPath $expandedPath)) { continue }

        $bindings = @($site.Bindings.Collection | ForEach-Object { $_.bindingInformation + ' [' + $_.protocol + ']' })
        $hasWebBinding = $false
        foreach ($b in $site.Bindings.Collection) {
            if ($b.protocol -in @('http','https')) { $hasWebBinding = $true; break }
        }
        if (-not $hasWebBinding) { continue }

        $defaultDocs = @()
        try {
            $dd = Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter "system.webServer/defaultDocument/files" -Location $site.Name -Name '.'
            if ($dd) {
                $defaultDocs = @($dd | ForEach-Object { $_.value.ToString().ToLowerInvariant() })
            }
        } catch {
            # Fall back to stock names if per-site config can't be read

            $defaultDocs = @()
        }

        if (-not $defaultDocs -or $defaultDocs.Count -eq 0) {
            $defaultDocs = $stockNames
        }

        foreach ($doc in $defaultDocs) {
            if ($stockNames -notcontains $doc.ToLowerInvariant()) { continue }
            $candidate = Join-Path -Path $expandedPath -ChildPath $doc
            if (-not (Test-Path -LiteralPath $candidate -PathType Leaf)) { continue }

            $isStock = $false
            if ($doc.ToLowerInvariant() -eq 'iisstart.htm') {
                $isStock = $true
            } else {
                try {
                    $content = Get-Content -LiteralPath $candidate -Raw -ErrorAction Stop
                    foreach ($marker in $stockMarkers) {
                        if ($content -match [regex]::Escape($marker)) {
                            $isStock = $true
                            break
                        }
                    }
                } catch {
                    # If file exists but content cannot be read, keep evaluating other files

                }
            }

            if ($isStock) {
                $bindText = if ($bindings.Count -gt 0) { $bindings -join ', ' } else { 'no binding details' }
                $findings.Add("Site '$($site.Name)' serves probable stock IIS content via '$doc' in '$expandedPath' with bindings: $bindText") | Out-Null
                break
            }
        }
    } catch {
        # Continue checking other sites

        continue
    }
}

if ($findings.Count -gt 0) {
    Write-Result -State 'VULNERABLE' -Code 1 -Message ($findings -join '; ')
} else {
    Write-Result -State 'PATCHED' -Code 0 -Message 'No started IIS site appears to expose the stock default IIS page from common default documents.'
}

Sources

1. Tenable Nessus Plugin 106609
2. Microsoft Learn - Default Document <defaultDocument>
3. Microsoft Learn - Default Documents
4. OWASP WSTG - Fingerprint Web Server
5. OWASP WSTG - Test Application Platform Configuration
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS