CVE-2001-1463: The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/...

Security readout for executives and security teams

RhinoSoft Serv-U 3.0’s remote administration client can send the administrator password in clear text, even when S/KEY OTP is enabled. Anyone able to observe that network traffic could capture the password. The provided sources do not show active exploitation or a confirmed patch. Exposure is most likely where legacy RhinoSoft Serv-U 3.0 remote administration is still used across shared, untrusted, or monitorable networks. Evidence in the bundle is limited to Serv-U 3.0 and does not identify other affected versions or products. Treat this as a legacy credential-exposure issue. It is not KEV-listed in the provided data, but any remaining Serv-U 3.0 administrative use could expose privileged passwords and should be found and retired or isolated. Mitigation focus: Identify any RhinoSoft Serv-U 3.0 deployments and remote administration usage.; Check vendor or historical advisory guidance for fixed versions or replacement recommendations.; Avoid remote administration over untrusted networks until guidance is confirmed..

Prepared

Jun 29, 2026, 22:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.