CVE-2004-2254: Netwin Surgeldap

High severity, CVSS 7.5. EPSS: 8.4% chance of exploitation in the next 30 days.

SurgeLDAP 1.0g (Build 12), and possibly other versions before 1.0h, allows remote attackers to bypass authentication for the administration interface via a direct request to admin.cgi with a modified utoken parameter.

Affected products

• Netwin Surgeldap: version 1.0a only; version 1.0b only; version 1.0d only; version 1.0e only; version 1.0f only; version 1.0g only

Published 2004-12-31. Last modified 2026-06-16.