CVE-2012-10060 is a critical (CVSS 9.8) stack-based buffer overflow in the SSH service of Sysax Multi Server before 5.55. An overlong username during authentication is copied into a fixed buffer without a bounds check, which allows remote code execution as the service. Upgrade to 5.55 or later.
What's affected
Sysax Multi Server versions prior to 5.55, per the record. Version 5.55 is the first one not described as affected.
The flaw is in the SSH service. The record says the server copies a remote user's username into a fixed-size stack buffer without proper bounds checking, and that code runs in the context of the service. Because the username is sent before authentication finishes, no valid account is needed.
If you run only the FTP or web parts of Sysax and have the SSH service turned off, the exposure is lower, but upgrading is still the clean answer.
How to check if you're exposed
Check the installed version in the Sysax Multi Server administration tool or the Windows installed programs list. Anything below 5.55 is in scope.
Then check whether the SSH service listens, and where from:
nmap -sV -p 22 <server-address>
If the banner or port shows the Sysax SSH service on a version before 5.55, treat the host as exposed. Review firewall rules and port forwards that send traffic to this server, since they decide who can reach it.
Only test hosts that you own or are authorised to assess.
What to do now
- List every Sysax Multi Server and its version.
- Upgrade to 5.55 or later.
- Limit SSH access to the addresses that need it, or turn off the SSH service if you do not use it.
- Run the service with the least privileges it needs, because the overflow runs code in its context.
- Review the host for unexpected accounts, scheduled tasks and outbound connections if it was exposed.
Why it matters
The weakness is CWE-121 (Stack-based Buffer Overflow). Username handling is a classic place for it, because the server must read the string before it can decide whether the user is real. A copy without a length check turns an authentication prompt into a memory write.
The risk grows with the service's privileges. A server that runs as a powerful Windows account gives an attacker that account's reach. Running network services with limited rights is the main damage control when a bug like this appears.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Which version fixes this?
The record says versions prior to 5.55 are affected, so 5.55 or later.
Do I need valid credentials?
No. The overflow occurs when the username is supplied during authentication.
Sources
Last reviewed: 19 October 2026.
