CVE-2004-2254: SurgeLDAP 1.0g (Build 12), and possibly other versions before 1.0h, allows remote attackers to bypass authe...

Security readout for executives and security teams

This CVE describes an authentication bypass in the SurgeLDAP administration interface. A remote attacker may be able to reach admin functionality without valid credentials by abusing the admin.cgi token handling. The issue is very old, but any internet-exposed legacy SurgeLDAP 1.0g build 12 or pre-1.0h deployment should be treated seriously. Exposure is likely limited to legacy SurgeLDAP installations, especially systems still running 1.0g build 12 or pre-1.0h versions with the admin interface reachable from untrusted networks. Prioritize as high only where legacy SurgeLDAP remains deployed or externally reachable. The business risk is unauthorized administrative access, but urgency depends on whether this obsolete software is present. Mitigation focus: Identify any SurgeLDAP deployments and record exact versions/builds.; Prioritize upgrade or replacement for 1.0g build 12 and pre-1.0h systems.; Check NetWin or current vendor guidance before selecting a final fix path..

Prepared

Jun 29, 2026, 19:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.