CVE-2026-11554: TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation
A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege violation. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
vsftpdfrom your environment.If the FTP service is not required, uninstall or disable vsftpd on affected devices until a vendor-supplied fix or more specific remediation is available.
- Configuration
Review and update /etc/vsftpd.conf to enforce least privilege: disable anonymous FTP and any unnecessary write/upload features, ensure users are chrooted where appropriate, and tighten file and directory permissions. After making changes, restart the vsftpd service and verify behavior.
vsftpd (/etc/vsftpd.conf) least-privilege related configuration = enforce least privilege (disable anonymous/write, chroot users, restrict file permissions) - Compensating control
Until a patch or configuration fix is applied, restrict network access to the FTP service (e.g., block or allow port 21 and related ports only from trusted management IPs, require access via VPN) at the perimeter/firewall.
- Operational
Because a public exploit exists, monitor FTP and system logs for signs of exploitation, rotate any credentials or keys that may have been exposed, and follow incident-response procedures (isolate and rebuild affected hosts) if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11554?
CVE-2026-11554 has a medium severity score of 4.3.
How does CVE-2026-11554 impact the TOTOLINK CP450?
CVE-2026-11554 allows a least privilege violation in the vsftpd configuration which can be exploited remotely.
How can I fix CVE-2026-11554?
To fix CVE-2026-11554, ensure that the vsftpd configuration is properly secured and review the permissions set within /etc/vsftpd.conf.
Is exploitation of CVE-2026-11554 easy?
Yes, exploitation of CVE-2026-11554 can be initiated remotely and has been publicly disclosed.
What component is affected by CVE-2026-11554?
CVE-2026-11554 affects the vsftpd component within the TOTOLINK CP450.