Xlight FTP Server versions before 3.9.5 allow an attacker to send a USER command with a username ending in the ":adm" suffix, causing the server to reveal its current GetTickCount() value. The disclosure occurs during the standard FTP 331 response before authentication and can be triggered without any special configuration or additional ports. This leak provides timing information that could aid in forensic analysis or further exploit development. The weakness is identified as CWE‑203: Information Exposure Through Unintended Information Disclosure.

Products affected are Xlight FTP Server, with all releases prior to version 3.9.5 vulnerable. Users running these older builds should verify their current version against the vendor’s release notes.

The moderate CVSS score of 6.9 reflects the potential for valuable timing data to be extracted by unauthenticated network attackers. The EPSS score of less than 1% indicates a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a simple network-based interaction over the default FTP port, requiring only a forged USER command. While the disclosure itself does not grant direct control, the accessed timing information may assist attackers in refining other attacks or improving the accuracy of diagnostics.