PT-2025-31980 · Netwin · Surgeftp

Published 2025-08-05 · Updated 2025-08-05 · CVE-2012-10028

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Netwin SurgeFTP versions 23c8 and earlier

Description Netwin SurgeFTP contains a flaw in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to the surgeftpmgr.cgi endpoint. This can lead to full remote code execution on the underlying system.

Recommendations Versions prior to 23c8 should be updated. As a temporary workaround, restrict access to the surgeftpmgr.cgi endpoint to minimize the risk of exploitation.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2012-10028

Affected Products

Surgeftp

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-10028 · Security Note
• https://t.me/CVEtracker/29234 · Telegram Post
• https://netwinsite.com/surgeftp · Note
• https://exploit-db.com/exploits/23601 · Note
• https://vulncheck.com/advisories/netwin-surgeftp-auth-rce · Note
• https://exploit-db.com/exploits/23522 · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/netwin_surgeftp_exec.rb · Note