CVE-2026-11554: TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-08 · updated 2026-07-23
Weakness: CWE-266

Description

A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege violation. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Affected products

TOTOLINK CP450: 4.1.0cu.747

References

https://vuldb.com/cve/CVE-2026-11554
https://vuldb.com/submit/834821
https://vuldb.com/vuln/369164
https://vuldb.com/vuln/369164/cti
https://www.notion.so/TOTOLink-CP450-V4-1-0cu-747-3671f5ba989080c3b39ac3984d2ff44d?source=copy_link
https://www.totolink.net/

Get alerted when CVE-2026-11554 or the next vulnerability affects your stack