Vulnerability · Published Jun 8, 2026 · Assigned by VulDB
CVE-2026-11554TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation
Medium 4.3
In plain English
A medium-severity security flaw in CP450 from TOTOLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 89.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege violation. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
Weakness: CWE-272, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-369164 | TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation vdb-entry
- VDB-369164 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-11554 | CVE Analysis and Report third-party-advisory
- Submit #834821 | TOTOLink CP450 V4.1.0cu.747 Misconfiguration third-party-advisory
- https://www.notion.so/TOTOLink-CP450-V4-1-0cu-747-3671f5ba989080c3b39ac3984d2ff44d?source=copy_link exploit
- https://www.totolink.net/ product