CVE-2012-10060

Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service.

• CWE-121

• https://advisories.checkpoint.com/defense/advisories/public/2012/cpai-23-sepc.htmlThird Party Advisory
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rbExploit, Third Party Advisory
• https://web.archive.org/web/20120302203344/http://www.pwnag3.com/2012/02/sysax-multi-server-ssh-username-exploit.htmlExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/18535Exploit, VDB Entry
• https://www.exploit-db.com/exploits/18557Exploit, VDB Entry
• https://www.sysax.com/Product
• https://www.vulncheck.com/advisories/sysax-multi-server-ssh-username-buffer-overflowThird Party Advisory
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rbExploit, Third Party Advisory

Published

Aug 13, 2025

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10055ComSndFTP FTP Server version 1.3.7 Beta contains a format st…9.3
• CVE-2012-10056PHP Volunteer Management System v1.0.2 contains an arbitrary…8.7
• CVE-2012-10057Lattice Semiconductor ispVM System v18.0.2 contains a buffer…8.4
• CVE-2012-10058RabidHamster R4 v1.25 contains a stack-based buffer overflow…10
• CVE-2012-10059Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a po…9.4
• CVE-2012-1006Multiple cross-site scripting (XSS) vulnerabilities in Apach…
• CVE-2012-10061Sockso Music Host Server versions <= 1.5 are vulnerable to a…8.7
• CVE-2012-10062A vulnerability in XAMPP, developed by Apache Friends, versi…8.7
• CVE-2012-10063Nagios XI versions prior to 2012R1.3 contain a SQL injection…9.8
• CVE-2012-10064Omni Secure Files plugin versions prior to 0.1.14 contain an…9.3
• CVE-2012-1007Multiple cross-site scripting (XSS) vulnerabilities in Apach…
• CVE-2012-1008OfficeSIP Server 3.1 allows remote attackers to cause a deni…