CVE-2026-67193 in FTP Server
Summary
by MITRE • 07/29/2026
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability resides in xlight FTP Server versions prior to 395, representing a significant information disclosure flaw that exposes system timing data to unauthenticated attackers. The vulnerability specifically manifests when an attacker sends a USER command with a username ending in the :adm suffix, which triggers an internal administrative protocol path within the standard FTP listener. This design flaw allows adversaries to exploit the pre-authentication state of the FTP service to extract the server's current GetTickCount() value, which represents the number of milliseconds since system boot. The GetTickCount() function provides timing information that can be leveraged for various attack vectors including system fingerprinting and timing-based attacks that rely on precise temporal measurements.
The technical implementation of this vulnerability exploits the server's insufficient input validation and access control mechanisms within its FTP protocol handling. When processing the USER command with the specific :adm suffix, the server inadvertently follows an administrative code path that was intended to be restricted to authenticated administrators. This creates a direct information leakage channel that bypasses normal authentication requirements and operates entirely within the standard FTP port 21 listener. The vulnerability is particularly concerning because it requires no special configuration changes or additional network ports to exploit, making it highly accessible to attackers who simply need to establish a basic FTP connection to the server.
The operational impact of this vulnerability extends beyond simple information disclosure, as timing information can be used for sophisticated attacks that rely on temporal analysis. Attackers can utilize the leaked GetTickCount() values to perform timing-based attacks against other services or protocols running on the same system. This information leakage can also aid in system fingerprinting efforts, allowing attackers to determine server uptime and potentially identify specific versions of operating systems or applications based on timing characteristics. The vulnerability creates a persistent threat vector that remains active as long as the vulnerable FTP server is operational, since no authentication is required to trigger the information leak.
From a cybersecurity framework perspective, this vulnerability maps directly to CWE-200 Information Exposure and potentially CWE-352 Cross-Site Request Forgery in its impact scope. The ATT&CK framework categorizes this under T1082 System Information Discovery as it enables adversaries to gather system timing data that can be used for further reconnaissance activities. The vulnerability represents a classic case of insufficient access control where administrative functions are exposed through normal user pathways, violating the principle of least privilege and creating an attack surface that should remain restricted to authorized administrators only.
Mitigation strategies should focus on immediate patching of the xlight FTP Server to version 395 or later, which addresses the improper access control in the USER command processing. Organizations should also implement network segmentation to limit access to FTP services, particularly on port 21, and consider disabling unnecessary administrative protocol paths that are not required for standard FTP operations. Network monitoring should be enhanced to detect unusual patterns in FTP USER command usage, particularly those containing the :adm suffix. Additionally, administrators should review all FTP server configurations to ensure that administrative functions are properly restricted and that timing information is not exposed through normal service operations. Regular security assessments of file transfer services should include testing for similar access control bypass vulnerabilities that could expose system-level information to unauthenticated users.