CVE-2001-1354 EXPLOIT
4.6
MEDIUM · CVSS 2.0 · EPSS 0.8% (pctl 55)
Patch early
A public exploit exists.
Description
NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
Scoring
| CVSS | 4.6 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:L/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 0.78% — more likely to be exploited than 55% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2001-07-20 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| netwin | dmail |
| netwin | surgeftp |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | NetWin DMail 2.x / SurgeFTP 1.0/2.0 - Weak Password Encryption | 2001-07-20 |
References
→ the Explorer · watch your stack · NVD