CVE-2001-1355: Netwin Dmail

High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days.

Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to (1) the -del command or (2) the -lookup command.

Affected products

• Netwin Dmail: version 2.5d only; version 2.7 only; version 2.7q only; version 2.7r only; version 2.8e only; version 2.8f only; …
• Netwin Surgeftp: version 1.0b only; version 2.0a only; version 2.0b only

Published 2001-07-20. Last modified 2026-06-16.