The MiCode FileExplorer software contains an authentication bypass flaw in its embedded SwiFTP component. When the server receives any username and password pair via the PASS command, it accepts the credentials unconditionally, granting the caller full read, write, and delete permissions on all files exposed through the FTP interface. This flaw directly compromises the confidentiality, integrity, and availability of data stored on the affected system.

All released versions of MiCode FileExplorer are affected because the bug resides in the core SwiFTP module that is always included in the product binary. The project is declared end‑of‑life, meaning that no security updates or patches will be released, so every deployed instance that enables the FTP feature and exposes it over the network requires remediation.

The flaw carries a CVSS v3 score of 9.3, denoting critical severity, while an EPSS score of less than 1% indicates that the likelihood of automated exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is over the network, as an attacker can reach the FTP service on the standard port (typically 21) from any external host with network connectivity. Without a vendor patch, the risk to organizations remains high until the embedded FTP server is disabled or removed.