CVE-2026-11554

MediumCVSS 4.3

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A least privilege violation was detected in the vsftpd component of TOTOLINK CP450 version 4.1.0cu.747 in the file /etc/vsftpd.conf. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Risk Assessment

A remote attacker can exploit excessive privileges to gain unauthorized access to the file system or perform unwanted operations on the router.

Recommendation

It is recommended to update the TOTOLINK CP450 firmware to the latest version and restrict the privileges of the vsftpd component.

Other vulnerabilities in TOTOLINK CP450

CVE-2026-85031Critical
A vulnerability was found in TOTOLINK CP450 4.1.0 in an unknown function of the file /cgi-bin/cstecgi.cgi. Manipulating the topicurl argument results in a buffer overflow. Remote exploitation is possible.

Original NVD description (English source)

A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege violation. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.