Description
A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation leads to least privilege violation. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-06-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the vsftpd configuration file of the TOTOLINK AC1200 T8 router, allowing an attacker to violate the system’s least privilege rule—a direct manifestation of CWE‑272, Least Privilege Violation, and also a permissions issue per CWE‑266. This can result in unauthorized elevation of privileges and potential modification of the device’s operating state.

Affected Systems

Devices from TOTOLINK branded as AC1200 T8, specifically those running firmware version 4.1.5cu.8611, are affected. No other product revisions are listed in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack may be initiated remotely and a publicly disclosed exploit exists, meaning attackers can achieve the privilege‑escalation flaw without local access.

Generated by OpenCVE AI on June 8, 2026 at 07:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the firmware to a version that fixes the vsftpd configuration issue.
  • If FTP is not needed, disable the FTP service or remove vsftpd from the system.
  • Limit inbound connections to the router’s FTP port to trusted IP addresses or isolate the device behind a firewall.

Generated by OpenCVE AI on June 8, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 09 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 08 Jun 2026 06:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation leads to least privilege violation. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Title TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation
First Time appeared Totolink
Totolink ac1200 T8
Weaknesses CWE-266
CWE-272
CPEs cpe:2.3:a:totolink:ac1200_t8:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink ac1200 T8
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink Ac1200 T8
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-09T16:06:47.456Z

Reserved: 2026-06-07T10:21:03.518Z

Link: CVE-2026-11494

cve-icon Vulnrichment

Updated: 2026-06-09T16:05:48.932Z

cve-icon NVD

Status : Deferred

Published: 2026-06-08T07:16:27.210

Modified: 2026-06-09T17:17:01.100

Link: CVE-2026-11494

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-08T08:30:19Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-272

    Least Privilege Violation