CVE-2026-67193 – Xlight FTP Server < 3.9.5 Information Disclosure via USER Command

CVE ID :CVE-2026-67193

Published : July 29, 2026, 4:17 p.m. | 24 minutes ago

Description :Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server’s current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.

Severity: 6.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…