Xlight FTP Server (< 3.9.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xlight-ftp-server--3.9.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 29 Jul 2026 16:18:31 +0000Pre-Authentication Remote Code Execution in Xlight FTP Serverhttps://feed.craftedsignal.io/briefs/2026-07-xlight-ftp-rce/Wed, 29 Jul 2026 16:18:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-xlight-ftp-rce/Xlight FTP Server versions prior to 3.9.5 contain a pre-authentication stack buffer overflow vulnerability triggered by malformed SSH packets, potentially leading to remote code execution.Xlight FTP Server versions prior to 3.9.5 are susceptible to a pre-authentication stack-based buffer overflow vulnerability (CVE-2026-67192). The vulnerability exists within the SSH implementation of the server, specifically when handling GCM (Galois/Counter Mode) cipher negotiation. An unauthenticated attacker can send a maliciously crafted SSH packet containing an unvalidated length field to the GCM decryption routine. This oversight allows the attacker to corrupt the stack memory, specifically overwriting the stack cookie and the return address. Successful exploitation permits the attacker to achieve remote code execution before the authentication process is ever completed. This flaw poses a high risk as it requires no credentials and can be triggered during the initial stages of an SSH session.

Attack Chain

  1. An attacker establishes an unauthenticated TCP connection to the Xlight FTP Server on the configured SSH port.
  2. The attacker initiates the SSH version exchange and key exchange (KEX) process.
  3. The attacker requests the use of a GCM cipher suite during the SSH negotiation phase.
  4. The attacker sends a specially crafted SSH packet containing a manipulated length field that exceeds expected boundaries.
  5. The Xlight FTP Server's GCM decryption function processes the unvalidated length field, resulting in a stack buffer overflow.
  6. The overflow overwrites critical stack memory, including the stack canary and the function return address.
  7. The function execution returns to an attacker-controlled address or a gadget chain.
  8. The attacker achieves arbitrary code execution on the server host with the privileges of the FTP service.

Impact

Successful exploitation of CVE-2026-67192 allows unauthenticated remote attackers to gain code execution on affected Xlight FTP servers. This compromises the integrity and confidentiality of the entire server environment, potentially allowing for data exfiltration, lateral movement within the network, or the installation of persistent backdoors. Organizations running exposed Xlight FTP services prior to version 3.9.5 are at risk of complete system compromise.

Recommendation

  • Immediately upgrade Xlight FTP Server to version 3.9.5 or later to remediate CVE-2026-67192.
  • Until patching is possible, restrict network access to the Xlight FTP server to trusted IP addresses using a firewall.
  • Deploy network-based intrusion detection signatures capable of inspecting SSH KEX packets for anomalous length values or malformed GCM negotiation structures.
  • Monitor server logs for unexpected crashes or service restarts which may indicate failed or repeated exploitation attempts.
]]>highadvisoryremote-code-executionbuffer-overflowftp