CVE-2026-11494: TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation
A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation leads to least privilege violation. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
vsftpdfrom your environment.If FTP functionality is not required, uninstall or disable the vsftpd service to eliminate the vulnerable component.
- Configuration
Ensure /etc/vsftpd.conf is owned by root and not writable by unprivileged users (e.g., chown root:root and remove group/other write permissions such as chmod 600). This prevents unauthorized manipulation of the configuration file.
vsftpd /etc/vsftpd.conf file permissions = restrict write access to root only - Compensating control
Restrict remote access to the FTP service (vsftpd) using network controls: block or limit access to the FTP port (e.g., TCP/21) to trusted IP addresses via firewall rules or ACLs, and deny access from untrusted networks.
- Operational
Audit /etc/vsftpd.conf for unauthorized changes and restore from a known-good backup if tampering is found. Monitor system and FTP logs for signs of exploitation and investigate any suspicious activity; if compromise is suspected, follow incident response procedures (including credential rotation as appropriate).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11494?
CVE-2026-11494 has a medium severity score of 4.3.
What does CVE-2026-11494 involve?
CVE-2026-11494 involves a least privilege violation in the vsftpd component of the TOTOLINK AC1200 T8.
How can I mitigate the risk of CVE-2026-11494?
To mitigate CVE-2026-11494, ensure that appropriate permissions are set on the vsftpd configuration file.
Is CVE-2026-11494 exploitable remotely?
Yes, CVE-2026-11494 can be exploited remotely.
What impact does CVE-2026-11494 have on system integrity?
CVE-2026-11494 allows for integrity violations due to least privilege issues.