CVE-2001-1356: Netwin Surgeftp

High severity, CVSS 10.0. EPSS: 3.8% chance of exploitation in the next 30 days.

NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.

Affected products

• Netwin Surgeftp: version 2.0a only; version 2.0b only; version 2.0c only; version 2.0d only; version 2.0e only; version 2.0f only

Published 2001-08-04. Last modified 2026-06-16.