CVE-2001-1354: Netwin Dmail

Medium severity, CVSS 4.6. EPSS: 0.8% chance of exploitation in the next 30 days.

NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.

Affected products

• Netwin Dmail: version 2.5d only; version 2.7 only; version 2.7q only; version 2.7r only; version 2.8e only; version 2.8f only; …
• Netwin Surgeftp: version 1.0b only; version 2.0a only; version 2.0b only

Published 2001-07-20. Last modified 2026-06-16.