TOTOLINK CP450 CVE-2026-11554

Exploitation requires the attacker to hold a valid low-privilege account on the TOTOLINK CP450 device's FTP service (PR:L confirmed by CVSS vector). The vsftpd service must be running and accessible over the network - whether this is a default-on configuration for the CP450 firmware is not confirmed by the available data, though FTP is commonly enabled by default on TOTOLINK SOHO devices. No user interaction is required (UI:N) and no special attack conditions are needed beyond credentials (AT:N). What limits exploitation: authentication is mandatory (no unauthenticated path exists per PR:L), impact is bounded to low integrity effects with no confidentiality or availability consequence, and the attack is scoped entirely to the vulnerable system with no lateral movement to subsequent systems reflected in the CVSS vector (SC:N/SI:N/SA:N). Exploitation is not viable against devices where FTP is disabled or where the FTP port is firewalled from untrusted networks.

The overall risk posture is low. The CVSS 4.0 base score of 2.1 accurately captures the limited impact: VI:L indicates only minor integrity effects on the vulnerable system, with no confidentiality impact (VC:N) and no availability impact (VA:N), and all subsequent system impact metrics are also None. The attack vector is network (AV:N) with low complexity (AC:L) and no attack requirements (AT:N), but low privileges are required (PR:L), meaning unauthenticated exploitation is NOT possible - an attacker must already hold a valid FTP credential on the device. The exploit maturity modifier E:P confirms a proof-of-concept exists, which marginally elevates practical risk above theoretical. There is no CISA KEV listing, so confirmed active exploitation is absent. EPSS data was not provided in the source intelligence; exploitation probability is therefore unquantifiable from available data. The combination of low impact scope, authentication prerequisite, and absence of KEV listing places this firmly in the 'low priority' category for most organizations, though embedded router firmware often goes unpatched - defenders managing TOTOLINK CP450 deployments should weigh that operational reality. No conflicting signals exist between data sources; the CVSS vector is consistent with the described behavior.

An attacker who has obtained low-privilege FTP credentials for a TOTOLINK CP450 device - through credential stuffing, default credential abuse, or social engineering - connects remotely to the device's FTP service over the network. By exploiting the least privilege misconfiguration in /etc/vsftpd.conf, the attacker accesses or modifies files outside their intended FTP directory scope, potentially overwriting configuration files or injecting content into accessible paths. A publicly available proof-of-concept hosted on Notion (https://www.notion.so/TOTOLink-CP450-V4-1-0cu-747-3671f5ba989080c3b39ac3984d2ff44d) documents this technique, lowering the skill barrier for exploitation.