TOTOLINK AC1200 T8 CVE-2026-11494

The vsftpd FTP service must be enabled and network-accessible on the TOTOLINK AC1200 T8 - this is a non-default-disabled service in many embedded router firmwares but should be verified per deployment. Low-privilege authentication is required (PR:L per CVSS vector), meaning the attacker must possess valid FTP credentials for the device; unauthenticated exploitation is not supported by the available data. Attack complexity is low (AC:L), so no race condition, special timing, or environmental precondition is needed beyond valid credentials and network reachability. Exploitation is limited by the authentication requirement and the low integrity-only impact scope (C:N, A:N) - attackers cannot directly read sensitive data or crash the service through this vector alone. Routers with FTP disabled or FTP access firewalled to trusted hosts only are not exposed to network-based exploitation of this vulnerability.

The CVSS base score of 4.3 (Medium) accurately reflects a constrained risk profile: low integrity impact only, no confidentiality or availability consequence, and a requirement for low-level authentication (PR:L). The attack complexity is low (AC:L) with no user interaction needed, meaning that once credentials are obtained, exploitation is straightforward. The temporal modifier E:P (proof-of-concept exploit publicly available) elevates urgency slightly, and the remediation level RL:X indicates no official fix has been defined. RC:R (reasonable - not confirmed) means the vulnerability has not been independently verified by the vendor, introducing some uncertainty. The absence of a CISA KEV listing confirms no observed in-the-wild mass exploitation. EPSS data was not provided; given the low CVSS score and authentication requirement, broad automated exploitation is unlikely. Real-world risk is most significant in environments where TOTOLINK AC1200 T8 routers expose FTP services to untrusted networks or where router credentials are weak or default. The tags 'Information Disclosure' alongside CWE-272 suggest secondary risk of configuration leakage through the vsftpd service, though CVSS records no confidentiality impact - this discrepancy should be verified with the vendor or by reviewing the published POC.

An attacker with low-privilege credentials to the TOTOLINK AC1200 T8 - obtained via default credentials, credential stuffing, or prior access - connects to the vsftpd FTP service exposed over the network. By leveraging the misconfigured permissions in vsftpd.conf, the attacker performs write operations or accesses FTP-accessible paths beyond their authorized scope, potentially modifying files or configurations on the device. A publicly available proof-of-concept (documented on Notion, referenced in VulDB entry 369114) lowers the skill bar required to execute this attack.