This threat highlights that about 50% of the estimated 6 million FTP servers accessible over the internet do not implement encryption, relying on the legacy FTP protocol. FTP transmits data, including credentials, in plaintext, making it vulnerable to interception and man-in-the-middle attacks. The continued use of unencrypted FTP servers increases the risk of sensitive data exposure. There is no indication of a vendor patch or official remediation, as FTP is a protocol rather than a software product, and the issue is primarily one of configuration and protocol choice.

Data transmitted via unencrypted FTP servers can be intercepted by attackers, potentially exposing sensitive information such as usernames, passwords, and transferred files. This exposure can lead to unauthorized access and data breaches. However, no active exploitation campaigns have been reported, and the impact is contingent on the sensitivity of the data transmitted and the security posture of the organizations running these servers.

Organizations should transition from using unencrypted FTP to secure alternatives such as FTPS or SFTP, which provide encryption for data in transit. Where possible, disable legacy FTP services or restrict their use to trusted internal networks. Since this is a protocol-level issue without a direct patch, remediation involves configuration changes and adopting secure file transfer protocols.