Medium severity · published Jun 9, 2026
CVE-2026-11620
TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
EX200 · TOTOLINK
4.0.3c.7646 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11620
vuldb.com
https://vuldb.com/cve/CVE-2026-11620
vuldb.com
https://vuldb.com/submit/834825
vuldb.com
https://vuldb.com/vuln/369301
vuldb.com
https://vuldb.com/vuln/369301/cti
www.notion.so
https://www.notion.so/TOTOLink-EX200-V4-0-3c-7646_B20201211-3671f5ba989080ccaa41d9f76fb1906b?source=copy_link
www.totolink.net
https://www.totolink.net/
More from EX200
10.0
CVE-2026-114383
TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow
10.0
CVE-2026-114382
TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
9.8
CVE-2024-31810
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample
9.8
CVE-2024-31807
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost function
9.8
CVE-2021-43711
The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters