CVE-2001-1356 describes a critical vulnerability in NetWin SurgeFTP 2.0f and earlier, where weak password encryption, a fixed salt, and modulo 40 calculations enable remote attackers to brute-force administrator credentials on port 7021. This vulnerability carries a CVSS score of 10.0 (HIGH), indicating a network-based attack with low complexity, requiring no authentication, and leading to complete compromise of confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0aCPE matchmatch criteria | cpe:2.3:a:netwin:surgeftp:2.0a:*:*:*:*:*:*:* | ||
2.0bCPE matchmatch criteria | cpe:2.3:a:netwin:surgeftp:2.0b:*:*:*:*:*:*:* | ||
2.0cCPE matchmatch criteria | cpe:2.3:a:netwin:surgeftp:2.0c:*:*:*:*:*:*:* | ||
2.0dCPE matchmatch criteria | cpe:2.3:a:netwin:surgeftp:2.0d:*:*:*:*:*:*:* | ||
2.0eCPE matchmatch criteria | cpe:2.3:a:netwin:surgeftp:2.0e:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.