CVE-2012-10028: Netwin SurgeFTP <= v23c8 Authenticated RCE
Published Aug 5, 2025
·Updated
Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to surgeftpmgr.cgi. This can lead to full remote code execution on the underlying system.
Affected Software
1 affected component
Netwin SurgeFTP<23c8
Event History
Aug 5, 2025
CVE Published
via MITRE·08:04 PM
Data Sourced
via MITRE·08:04 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2012-10028?
CVE-2012-10028 has a high severity rating due to its potential for enabling full remote code execution.
2
How do I fix CVE-2012-10028?
To fix CVE-2012-10028, upgrade to a version of Netwin SurgeFTP that is later than 23c8.
3
What systems are affected by CVE-2012-10028?
CVE-2012-10028 affects Netwin SurgeFTP versions up to and including 23c8.
4
What type of vulnerability is CVE-2012-10028?
CVE-2012-10028 is a command injection vulnerability in the web-based administrative console.
5
Can CVE-2012-10028 be exploited remotely?
Yes, CVE-2012-10028 can be exploited by authenticated users to execute arbitrary commands remotely.