Executive brief
Xlight FTP Server, a high-performance file transfer server, is vulnerable to an information disclosure flaw. An unauthenticated attacker can remotely obtain internal system timing information by sending a specially crafted username. This data can be used to facilitate more complex attacks against the server's security mechanisms.
Technical details
Xlight FTP Server before version 3.9.5 is vulnerable to an observable discrepancy (CWE-203) during the authentication phase. By sending a FTP 'USER' command with a username ending in the ':adm' suffix, an unauthenticated remote attacker can trigger an internal administrative protocol path. This causes the server to leak its current 'GetTickCount()' value within the standard FTP 331 response. This timing information disclosure occurs on the standard FTP listener without requiring access to a separate administrative port or specific configuration changes. The vulnerability was patched in version 3.9.5.
Affected products
- Xlight Xlight FTP Server before 3.9.5
Timeline
- 2026-07-01: patched: Version 3.9.5 released fixing security vulnerabilities
- 2026-07-29: disclosed: CVE-2026-67193 published