CVE Daily

CVE-2012-10028

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based...

High CVSS 8.6

Overview

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system.

CWE: CWE-78 Published: 2025-08-05T20:15:33.710
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 8.6 (HIGH)
  • Detected tags: rce (tag impact: VERY HIGH)

Recommended actions:

  • Patch/upgrade immediately (remote code execution).
  • Reduce exposure (WAF/segmentation), minimize attack surface.

Recommended tools

Tags