CVE-2026-67193 Overview
CVE-2026-67193 is an information disclosure vulnerability in Xlight FTP Server versions before 3.9.5. The flaw allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers reach the admin protocol path through the standard FTP listener before authentication, leaking timing data through the FTP 331 response. No separate port or configuration change is required to trigger the leak. The weakness is tracked under CWE-203 (Observable Discrepancy).
Critical Impact
Unauthenticated network attackers can extract system timing values from Xlight FTP Server, aiding reconnaissance and downstream attacks such as predicting time-based tokens or randomness.
Affected Products
- Xlight FTP Server versions prior to 3.9.5
- Standard FTP listener exposing the admin protocol path
- Deployments with default configuration (no separate admin port required)
Discovery Timeline
- 2026-07-29 - CVE-2026-67193 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-67193
Vulnerability Analysis
Xlight FTP Server exposes an internal admin protocol path within its standard FTP listener. When the server receives a USER command whose username ends with the :adm suffix, it routes the request into the admin handler before authentication is enforced. The handler returns an FTP 331 response that embeds the current value of the Windows GetTickCount() API. This value represents the number of milliseconds since system boot and can be read by any network client that can reach the FTP port.
Attackers use the disclosed tick count to fingerprint uptime, correlate reboots, or seed attacks against time-dependent security controls. In systems where session identifiers, tokens, or pseudo-random values derive from tick-based state, an accurate GetTickCount() reading reduces the search space for guessing or prediction attacks.
Root Cause
The root cause is improper separation between the public FTP protocol handler and the administrative protocol path. The server accepts admin-mode requests over the standard listener based solely on a username suffix, without authentication or transport separation. The admin handler then returns internal state in an observable protocol response, matching the pattern described in CWE-203.
Attack Vector
The attack is remote, network-based, and requires no privileges or user interaction. An attacker connects to the FTP service and issues a single command of the form USER <anystring>:adm. The server replies with an FTP 331 line that contains the leaked GetTickCount() value. Repeated queries let the attacker sample timing state over intervals of interest.
No verified public exploit code is currently linked to this CVE. Technical details are described in the VulnCheck Advisory.
Detection Methods for CVE-2026-67193
Indicators of Compromise
- FTP USER commands where the username terminates with the :adm suffix in server logs or packet captures.
- Outbound FTP 331 responses containing numeric tick values returned to unauthenticated clients.
- Repeated pre-authentication USER command probes from a single source IP over short intervals.
Detection Strategies
- Inspect FTP protocol traffic on port 21 for USER payloads matching the pattern *:adm and flag any that receive a 331 response without a subsequent successful PASS.
- Correlate FTP session logs to identify clients that disconnect immediately after receiving a 331 response, indicating scripted timing extraction.
- Baseline the length and content of FTP 331 responses; deviations that include numeric tick data warrant investigation.
Monitoring Recommendations
- Enable verbose logging on Xlight FTP Server and forward logs to a centralized SIEM for pattern-based alerting.
- Monitor pre-authentication FTP command volume per source IP to identify reconnaissance sweeps against the admin protocol path.
- Track upgrade status of Xlight FTP Server instances against version 3.9.5 to identify unpatched exposure.
How to Mitigate CVE-2026-67193
Immediate Actions Required
- Upgrade Xlight FTP Server to version 3.9.5 or later on all affected hosts.
- Restrict inbound access to the FTP listener to trusted networks using firewall or ACL rules until patching is complete.
- Audit FTP logs for prior USER *:adm requests to determine whether reconnaissance has already occurred.
Patch Information
The vendor has addressed the vulnerability in Xlight FTP Server 3.9.5. Refer to the Xlight FTP Server Release Notes for the fixed build and download the current version from the vendor site.
Workarounds
- Place the FTP service behind a network segment reachable only from authenticated VPN clients if immediate patching is not possible.
- Deploy a protocol-aware proxy or FTP-inspecting firewall that blocks USER commands ending in :adm before they reach the server.
- Disable public FTP access and require SFTP or FTPS through a hardened gateway until the upgrade is applied.
# Example iptables rule restricting FTP access to a management subnet
iptables -A INPUT -p tcp --dport 21 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
