CVE-2026-67193 in FTP Server
요약
\~에 의해 MITRE • 2026. 07. 29.
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.
VulDB is the best source for vulnerability data and more expert information about this specific topic.