CVE-2026-11620
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A least privilege violation was discovered in the vsftpd component of TOTOLINK EX200 router version 4.0.3c.7646. Manipulation of the /etc/vsftpd.conf file allows remote exploitation. A public exploit is available.
Risk Assessment
An attacker can remotely gain unauthorized access to the FTP service, potentially leading to data leakage or device takeover.
Recommendation
Immediately update the TOTOLINK EX200 router firmware to the latest available version or apply temporary network security measures.
Other vulnerabilities in TOTOLINK EX200
See all- CVE-2026-114383Critical
In TOTOLINK EX200 5.2.3c.7200, the setWiFiAclAddConfig function in /cgi-bin/cstecgi.cgi of the wireless.so component is vulnerable to a stack-based buffer overflow via manipulation of the macAddress argument. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.
- CVE-2026-114382Critical
In TOTOLINK EX200 5.2.3c.7200, the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi of the lan.so component is vulnerable to a stack-based buffer overflow via manipulation of the Comment argument. The attack can be launched remotely, and the exploit has been released to the public and may be used for attacks.
Original NVD description (English source)
A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS