Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-29 | 2 | Disclosure2 |
| 2026-07-30 | 1 | Disclosure1 |
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-67193](https://www.vulncheck.com/advisories/xlight-ftp-server-information-disclosure-vi... https://www.vulncheck.com/advisories/xlight-ftp-server-information-disclosure-via-user-command #CVE #ZeroDay #PatchManagement
Post summary
The post announces CVE‑2026‑67193 and links to an external advisory, without providing technical or exploit details.
🚨*CVE* CVE-2026-67193 Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() va… https://www.cve.org/CVERecord?id=CVE-2026-67193 ----- Traducción: CVE-2026-67193 Xli… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑67193, an information‑disclosure vulnerability in Xlight FTP Server that permits unauthenticated attackers to read the server’s GetTickCount value. No PoC, exploit detail, or patch information is provided.
CVE-2026-67193 Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() va… https://www.cve.org/CVERecord?id=CVE-2026-67193
Post summary
This text announces an information disclosure vulnerability (CVE‑2026‑67193) in Xlight FTP Server that can leak the server’s GetTickCount to unauthenticated attackers.