CVE-2001-1356: NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 ca...

Security readout for executives and security teams

NetWin SurgeFTP 2.0f and earlier used weak password encryption for the administrator account. Because the scheme used a fixed salt and modulo 40 calculations, attackers could brute force password guesses against the admin service on port 7021 if it was reachable. Exposure is likely limited to legacy SurgeFTP 2.0f or earlier installations with the administrative service reachable on port 7021. Internet-facing or broadly reachable admin interfaces carry the highest business risk. Treat this as a legacy exposure cleanup issue. It is not documented as actively exploited here, but an exposed administrative service with weak password protection can create avoidable compromise risk. Mitigation focus: Identify and remove or replace SurgeFTP 2.0f and earlier installations.; Restrict administrative access on port 7021 to trusted management networks only.; Use strong, unique administrator credentials and rotate any legacy credentials..

Prepared

Jul 1, 2026, 06:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.