CVE-2017-17933: Netwin Surgeftp

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter.

Affected products

• Netwin Surgeftp: version 23f2 only

Published 2017-12-29. Last modified 2026-06-17.