CVE-2026-67193

Deferred Deferred - Pending Action

Xlight FTP Server Timing Information Disclosure via USER Command

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: VulnCheck

Description

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67193

Affected Vendors & Products

Vendor	Product	Version / Range
xlight	ftp_server	to 3.9.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

Xlight FTP Server before version 3.9.5 has an information disclosure flaw. Unauthenticated attackers can send a specially crafted USER command with a username ending in :adm to trigger the admin protocol path. This causes the server to leak its current GetTickCount() timing value in the FTP 331 response without needing additional ports or configuration changes.

Detection Guidance

To detect this vulnerability, send a USER command with a username ending in :adm to the FTP server and check if the 331 response includes timing information from GetTickCount(). Example: 'telnet <server> 21' then 'USER test:adm'.

Impact Analysis

This vulnerability allows attackers to gather timing information from the server, which could be used to infer system activity or assist in further attacks. While it does not directly allow data access or modification, the leaked timing data might aid in planning more sophisticated exploits against the FTP server or related systems.

Compliance Impact

This vulnerability may impact compliance by exposing system timing information, which could be considered sensitive under certain regulations. While it does not directly lead to data breaches, it may violate requirements for protecting system metadata or maintaining secure configurations, potentially affecting adherence to standards like GDPR or HIPAA.

Mitigation Strategies

Upgrade Xlight FTP Server to version 3.9.5 or later to address the vulnerability. If upgrading is not possible, restrict access to the FTP server or disable the admin protocol path.

Hi! I’m here to help you understand CVE-2026-67193. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70