CVE-2026-29515

The PASS command handler in the SwiFTP server unconditionally grants access regardless of the provided username and password — any combination of login credentials is accepted. A network attacker can send any strings as authentication data, and the FTP server will log them in without verification. This violates both proper implementation of authentication mechanism (CWE-303) and enforcement of access control (CWE-862).

An attacker gains unauthorized access to the FTP server and can freely list, read, write, and delete files shared by the server, leading to disclosure or loss of data stored on the device.

The MiCode/Explorer project has reached end-of-life status — the manufacturer does not plan to release a patch. It is recommended to immediately stop using the built-in SwiFTP FTP server and uninstall the application or replace it with an actively maintained alternative file manager. As a temporary measure, network access to the FTP port used by the application should be blocked using a firewall or network isolation of the device.

MiCode FileExplorer (Xiaomi FileExplorer) with the built-in SwiFTP FTP server component. The MiCode/Explorer project has reached end-of-life status and will not receive further security updates.