CVE-2012-10028 Netwin SurgeFTP <= v23c8 Authenticated RCE

HighCVSS 8.6 EPSS 1.6% Framework module

Published: 2025-08-05 23:04
Updated: 2026-06-17 02:38
Exploit status: Public exploit available

Description

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to surgeftpmgr.cgi. This can lead to full remote code execution on the underlying system.

Affected products

Product	Affected versions	Fixed in
netwin surgeftp	<= 23c8	No fix listed

References

CVSS v4.0

8.6 High

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: High
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 8.6 · vulncheck
v4.0 8.6 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.63% (percentile 76.6)
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Netwin SurgeFTP Remote Command Execution Framework module · Metasploit Framework (Rapid7) · 2012-12-06