EUVD-2026-50400
GHSA-3c72-cvwm-9gqx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible pre-auth trigger with no complexity; only GetTickCount value leaked so C:L; no integrity or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.
AnalysisAI
Xlight FTP Server before 3.9.5 on Windows leaks the system's GetTickCount() value to unauthenticated remote attackers via the standard FTP listener. Sending a USER command with a username ending in the :adm suffix triggers an internal admin protocol code path pre-authentication, causing the server to embed Windows timing data in the FTP 331 response - no separate admin port or configuration change required. No active exploitation is confirmed (not in CISA KEV), but the attack is trivially executable against any default installation with network access to the FTP port.
Technical ContextAI
Xlight FTP Server is a Windows-native FTP server product, as confirmed by the use of GetTickCount(), a Win32 API returning milliseconds elapsed since system boot. The vulnerability is classified as CWE-203 (Observable Discrepancy), which covers information disclosure through differences in system behavior that an attacker can observe. The root cause is that the standard FTP listener (TCP port 21) contains a code branch triggered by a specific username suffix (:adm) that routes authentication through an admin protocol handler. This handler inadvertently returns the GetTickCount() value as part of the FTP 331 (Password Required) response. The leaked timing value reveals system uptime with millisecond granularity, which can assist in defeating timing-dependent mitigations such as ASLR. The CPE cpe:2.3:a:xlight:xlight_ftp_server:*:*:*:*:*:*:*:* with upper bound at 3.9.5 defines the affected scope.
RemediationAI
The primary fix is upgrading Xlight FTP Server to version 3.9.5 or later, as documented in the vendor changelog at https://www.xlightftpd.com/whatsnew.htm, which removes the admin protocol code path exposure within the pre-authentication flow of the standard FTP listener. If an immediate upgrade is not feasible, restrict access to the FTP port (typically TCP 21) via host-based or network firewall rules to trusted IP ranges only, which reduces the pool of attackers able to send the malicious USER command - note this may impact legitimate FTP client connectivity. Additionally, consider whether FTP can be replaced with SFTP or FTPS alternatives on the same host, eliminating the attack surface entirely. No other vendor-specified workarounds are identified in the provided references.
Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attacker
Pre-authentication heap buffer overflow in Xlight FTP Server before 3.9.5 lets remote unauthenticated attackers write pa
Remote code execution in Xlight FTP Server versions before 3.9.5 allows unauthenticated attackers to corrupt stack memor
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today