CVE-2026-67193CWE-203

CVE-2026-67193

Medium · published July 29, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00409 · 34.0th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-07-29T20:17Z
References (2)
https://www.vulncheck.com/advisories/xlight-ftp-server-information-disclosure-via-user-command · [email protected]https://www.xlightftpd.com/whatsnew.htm · [email protected]
EPSS history
Timeline
  • 29 JUL 15:51Z
    Xlight FTP Server < 3.9.5 Information Disclosure via USER Command
    cvelistv5