EUVD-2026-35025
GHSA-6c95-fqc7-4p3j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation leads to least privilege violation. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
Least-privilege violation in TOTOLINK AC1200 T8 firmware 4.1.5cu.8611 exposes the vsftpd FTP service to unauthorized integrity manipulation by low-privileged authenticated network users. The /etc/vsftpd.conf configuration grants excessive permissions beyond the principle of least privilege (CWE-272), allowing a low-privilege authenticated attacker to perform write operations they should not be authorized to execute. A proof-of-concept exploit has been publicly disclosed; the vulnerability is not confirmed in CISA KEV, but the CVSS temporal vector (E:P, RC:R) reflects publicly available exploit code with reasonable confidence in the report.
Technical ContextAI
The affected component is vsftpd (Very Secure FTP Daemon), a common FTP server embedded in TOTOLINK router firmware. The vulnerability resides in /etc/vsftpd.conf - vsftpd's primary configuration file - which governs user permissions, directory access, write capabilities, and privilege boundaries for FTP sessions. CWE-272 (Least Privilege Violation) indicates that the software or its configuration fails to reduce permissions to the minimum necessary, either by granting excessive file system access to authenticated FTP users or by misconfiguring chroot, write, or permission directives within vsftpd.conf. The CPE string (cpe:2.3:a:totolink:ac1200_t8:*:*:*:*:*:*:*:*) applies broadly across AC1200 T8 versions, though the specific confirmed firmware version is 4.1.5cu.8611. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms network-reachable exploitation requiring low-level authentication, with impact limited to low integrity - consistent with unauthorized write or permission manipulation within the FTP service boundary.
RemediationAI
No vendor-released patch has been identified at time of analysis; the CVSS remediation level field (RL:X) is undefined and no fix is referenced in the available advisory data. As a primary compensating control, disable the vsftpd FTP service entirely on the TOTOLINK AC1200 T8 if FTP access is not operationally required - this eliminates the attack surface completely but removes FTP-based file transfer capability. If FTP must remain enabled, restrict FTP access via firewall rules to trusted IP ranges only, blocking TCP port 21 from untrusted network segments; note this does not address the underlying privilege misconfiguration but limits exposure. Change all default or weak router credentials to reduce the risk of low-privilege authentication being trivially obtained. Monitor TOTOLINK's official site (https://www.totolink.net/) and the VulDB entry (https://vuldb.com/vuln/369114) for a firmware update. The public exploit is documented at the Notion reference included in the advisory - review it to understand the exact permission boundary being violated and apply targeted vsftpd.conf hardening (e.g., setting write_enable=NO, chroot_local_user=YES) if manual configuration is accessible.
Same weakness CWE-272 – Least Privilege Violation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today