CVE-2001-1356 NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks ag...
HighCVSS 10.0
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netwin surgeftp | = 2.0a | No fix listed |
| netwin surgeftp | = 2.0b | No fix listed |
| netwin surgeftp | = 2.0c | No fix listed |
| netwin surgeftp | = 2.0d | No fix listed |
| netwin surgeftp | = 2.0e | No fix listed |
| netwin surgeftp | = 2.0f | No fix listed |
References
- 20010804 SurgeFTP admin account bruteforcable mailing-list vendor-advisory
- surgeftp-weak-password-encryption(6961) vdb-entry vendor-advisory
- 3157 vdb-entry vendor-advisory