CVE-2026-67193
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Xlight FTP Server before version 3.9.5 discloses the GetTickCount() value to unauthenticated attackers by sending a USER command with a username ending in :adm. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication, leaking timing information from the FTP 331 response.
Risk Assessment
Disclosure of the GetTickCount() value can aid attackers in brute-force attacks or bypassing time-based protections, increasing the risk of account compromise.
Recommendation
Update Xlight FTP Server to version 3.9.5 or later.
Other vulnerabilities in Xlight FTP Server
See all- CVE-2026-67191Critical
Xlight FTP Server before version 3.9.5 has a pre-authentication heap buffer overflow vulnerability. A remote unauthenticated attacker can send a malformed SSH client identification string to write past the end of a heap buffer. A logic error in the recv loop enables exploitation before authentication.
- CVE-2026-67192High
Xlight FTP Server before version 3.9.5 contains a pre-authentication stack buffer overflow vulnerability. An unauthenticated attacker can send malformed SSH packets with GCM cipher negotiation, leading to stack corruption and potentially remote code execution.
- CVE-2019-25681High
Xlight FTP Server 3.9.1 has an SEH overwrite vulnerability allowing local attackers to crash the application and overwrite SEH pointers via a crafted 428-byte payload in the program execution field of virtual server configuration.
Original NVD description (English source)
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.