CVE-2001-1356 Weak cryptography in n/a
Weak password hashing in NetWin SurgeFTP allows remote attackers to brute force administrator credentials and gain unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2001-1356?
CVE-2001-1356 is a critical vulnerability in n/a, published on 11 Jun 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.
Which versions are affected by CVE-2001-1356?
It affects 1 product.
Products include Netwin Surgeftp.
How do I fix CVE-2001-1356?
No fix has been published for CVE-2001-1356 yet. Limit exposure of the affected software until one is available.
Is CVE-2001-1356 being exploited?
There is no known exploitation of CVE-2001-1356 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cq9x-572j-h52j.