PatchSiren

PatchSiren cyber security CVE debrief

CVE-2012-10060 Sysax Software CVE debrief

A critical stack-based buffer overflow vulnerability exists in Sysax Multi Server versions prior to 5.55. The flaw resides in the SSH service authentication handler, where an overly long username supplied by a remote attacker is copied to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service account. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and carries a CVSS 4.0 score indicating critical severity with network attack vector, low attack complexity, and no required privileges or user interaction. Multiple public exploits exist, including Metasploit modules and Exploit-DB entries, indicating widespread availability of attack tools. Despite the CVE ID suggesting 2012, the record was published to CVE.org on 2025-08-13 and modified on 2026-05-26, indicating this is a retroactive assignment or record update for a historically known vulnerability.

Vendor
Sysax Software
Product
Multi Server
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-13
Original CVE updated
2026-05-26
Advisory published
2025-08-13
Advisory updated
2026-05-26

Who should care

Organizations running Sysax Multi Server versions prior to 5.55 with SSH service enabled; security teams responsible for legacy Windows file transfer infrastructure; incident responders tracking exploitation of unauthenticated remote code execution vulnerabilities in managed file transfer solutions.

Technical summary

The SSH authentication handler in Sysax Multi Server prior to 5.55 contains a stack-based buffer overflow (CWE-121) triggered by supplying an excessively long username. The vulnerable code copies user-supplied input to a fixed-size stack buffer without length validation, enabling an unauthenticated remote attacker to overwrite the return address and execute arbitrary code. The service typically runs with SYSTEM or administrative privileges on Windows systems, maximizing the impact of successful exploitation. The vulnerability is network-accessible and requires no authentication or user interaction.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Sysax Multi Server to version 5.55 or later to remediate the buffer overflow vulnerability.
  • If patching is not immediately feasible, restrict SSH service access to trusted source IP addresses using network firewalls or host-based access controls.
  • Monitor SSH authentication logs for anomalous username lengths or repeated authentication failures that may indicate exploitation attempts.
  • Consider disabling the SSH service if not required for business operations, or replace with a hardened alternative.
  • Review and update incident response procedures to account for potential compromise of Sysax Multi Server systems.

Evidence notes

Vulnerability affects Sysax Multi Server versions prior to 5.55 per NVD CPE criteria. CVSS 4.0 vector confirms network-accessible, unauthenticated attack with high impact to confidentiality, integrity, and availability. Multiple exploit references confirm public weaponization.

Sources and references

Verified primary and authoritative sources

  • CVE-2012-10060 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2012-10060

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2012-10060 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2012-10060

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.