Vulnerability · Published Jun 8, 2026 · Assigned by VulDB
CVE-2026-11494TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation
Medium 4.3
In plain English
A medium-severity security flaw in AC1200 T8 from TOTOLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 88.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation leads to least privilege violation. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
Weakness: CWE-272, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-369114 | TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation vdb-entry
- VDB-369114 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-11494 | CVE Analysis and Report third-party-advisory
- Submit #834819 | TOTOLink AC1200T8 V4.1.5cu.8611 Misconfiguration third-party-advisory
- https://www.notion.so/TOTOLink-AC1200T8-V4-1-5cu-8611-3671f5ba989080a6aa03e6adbdd1d104?source=copy_link exploit
- https://www.totolink.net/ product