CVE-2012-10028

published 2025-08-05

CVE-2012-10028: Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary…

Priority P2 61 high 8.6 CVSS 4.0

AV N AC L AT N PR H UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
netwin	surgeftp	<= 23c8	—

Detection & IOCs extracted from sources · hover to see the quote

path surgeftpmgr.cgi↗

version SurgeFTP 23c8↗

• → Monitor for authenticated POST requests targeting surgeftpmgr.cgi on the SurgeFTP web-based administrative console, which may indicate command injection attempts. ↗
• → Exploitation requires valid credentials to the web-based administrative console; investigate any successful logins to the SurgeFTP admin panel followed by POST activity to surgeftpmgr.cgi. ↗
• → A public Metasploit module exists for this vulnerability targeting Netwin SurgeFTP 23c8 or prior; watch for exploit framework signatures in HTTP traffic. ↗

• · Exploitation is authenticated-only; the attacker must first obtain valid admin console credentials before achieving remote code execution. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78