CVE-2012-10028 — Netwin SurgeFTP <= v23c8 Authenticated RCE

Back Back to CVE browser

HIGH

Netwin SurgeFTP <= v23c8 Authenticated RCE

Published Aug 5, 2025

8.6

HIGH

CVSS 4.0

EPSS 1.40%

Description

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system.

Affected products

Vendor Netwin Product SurgeFTP Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=23c8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Netwin

SurgeFTP

unaffected

Version	Status	Constraints
0	affected	<=23c8

Remediation

No remediation recorded yet.

Metrics

1.40% 0.01401

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01401

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.40% (0.01401)	71.52th	v5 (v2026.06.15)
Jun 15, 2026	0.94% (0.00936)	56.02th	v5 (v2026.06.15)
Jun 13, 2026	76.51% (0.76511)	98.97th	v4 (v2025.03.14)
Jun 1, 2026	74.26% (0.74255)	98.86th	v4 (v2025.03.14)
Apr 21, 2026	57.68% (0.57681)	98.17th	v4 (v2025.03.14)
Jan 1, 2026	54.50% (0.54501)	97.95th	v4 (v2025.03.14)
Dec 5, 2025	64.80% (0.64795)	98.37th	v4 (v2025.03.14)
Oct 8, 2025	59.22% (0.59217)	98.12th	v4 (v2025.03.14)
Aug 6, 2025	0.29% (0.00288)	51.88th	v4 (v2025.03.14)

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

https://netwinsite.com/surgeftp/
product
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/netwin_surgeftp_exec.rb
exploit
https://www.exploit-db.com/exploits/23522
exploit
https://www.exploit-db.com/exploits/23601
exploit
https://www.vulncheck.com/advisories/netwin-surgeftp-auth-rce
third-party-advisory

Link	Providers	Tags
https://netwinsite.com/surgeftp/		product
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/netwin_surgeftp_exec.rb		exploit
https://www.exploit-db.com/exploits/23522		exploit
https://www.exploit-db.com/exploits/23601		exploit
https://www.vulncheck.com/advisories/netwin-surgeftp-auth-rce		third-party-advisory