EUVD-2026-35177
GHSA-j4v3-p9cr-3xhp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege violation. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Least privilege violation in TOTOLINK CP450 router firmware 4.1.0cu.747 allows low-privileged remote attackers to perform unauthorized integrity-affecting actions via the vsftpd FTP service, whose configuration in /etc/vsftpd.conf grants excessive permissions beyond operational necessity. The vulnerability carries a low CVSS 4.0 score of 2.1, reflecting constrained impact limited to low integrity effects on the vulnerable system with no confidentiality or availability consequence. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been confirmed, indicating no known active widespread exploitation at time of analysis.
Technical ContextAI
vsftpd (Very Secure FTP Daemon) is a widely embedded FTP server component commonly found in consumer and SOHO router firmware, including TOTOLINK devices. On the CP450 running firmware 4.1.0cu.747, the service configuration file /etc/vsftpd.conf is the root cause artifact. CWE-272 (Least Privilege Violation) identifies that the FTP daemon or its authenticated user sessions are granted permissions exceeding what is operationally required - for example, write or traversal rights to directories or files outside the FTP user's intended scope. The CPE string cpe:2.3:a:totolink:cp450:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting the affected version range may be broader than the single confirmed firmware string, though only 4.1.0cu.747 is explicitly named in the vulnerability report. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the service is network-reachable with no special attack conditions beyond holding low-privilege credentials.
RemediationAI
No vendor-released patch version has been identified in the available data - patch availability per TOTOLINK has not been independently confirmed from the provided references, and the TOTOLINK website (https://www.totolink.net/) did not yield a specific security advisory. As a primary compensating control, disable the FTP service on the CP450 entirely if it is not required for operations, as this removes the attack surface completely. If FTP must remain enabled, restrict network access to the FTP port (typically TCP 21) to only trusted IP addresses via firewall or access control list rules, limiting the pool of potential attackers who can present credentials. Review and harden /etc/vsftpd.conf to enforce least-privilege settings: set chroot_local_user=YES to confine users to their home directories, ensure write_enable is disabled unless explicitly necessary, and verify that anonymous access (anonymous_enable) is disabled. Monitor for firmware updates from TOTOLINK at https://www.totolink.net/ and apply any available patch for the CP450 product line. Note that hardening vsftpd.conf on embedded firmware may require custom firmware modification, which carries the risk of voiding support or introducing instability.
Buffer overflow in TOTOLINK CP450 4.1.0's web CGI handler allows low-privileged remote attackers to corrupt memory and l
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R
Same weakness CWE-272 – Least Privilege Violation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today