The vulnerability allows a system administrator or another privileged user to read a user’s password in clear text through activity logs. The exposed password can then be used to gain broader administrative access to the WS_FTP Server, potentially compromising other accounts and providing system‑wide control. The weakness is an example of improper log file handling (CWE‑532) and improper handling of sensitive information (CWE‑522).

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows are affected.

The CVSS score of 6.6 indicates moderate severity. Because the EPSS score is unavailable and the vulnerability is not listed in KEV, the current likelihood of exploitation is unknown but remains a concern for environments where administrators can view activity logs. The most likely attack vector is an internal privileged user who observes clear‑text passwords in the logs; a remote attacker would need to first achieve administrative credentials to exploit this weakness.