Xlight vulnerabilities
Published CVEs affecting Xlight products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-67193
Medium · 5.3
CWE-203 Jul 29, 2026
Xlight FTP Server < 3.9.5 Information Disclosure via USER Command
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.
CVE-2026-67192
High · 8.1
CWE-121 Jul 29, 2026
Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher
Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs.
CVE-2026-67191
Critical · 9.8
CWE-122 Jul 29, 2026
Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser
Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs.