High severityNVD Advisory· Published Aug 5, 2025· Updated Apr 15, 2026

CVE-2012-10028

Description

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to surgeftpmgr.cgi. This can lead to full remote code execution on the underlying system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Netwin/Surgeftpllm-fuzzy
Range: <=23c8

Patches

Vulnerability mechanics

References

netwinsite.com/surgeftp/nvd
raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/netwin_surgeftp_exec.rbnvd
www.exploit-db.com/exploits/23522nvd
www.exploit-db.com/exploits/23601nvd
www.vulncheck.com/advisories/netwin-surgeftp-auth-rcenvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000