This vulnerability arises from the manipulation of the /etc/vsftpd.conf configuration file on the TOTOLINK CP450. An attacker can alter the configuration to bypass the intended least‑privilege boundaries of the vsftpd component, potentially enabling higher‑privileged operations such as privileged file access or malformed command execution. The exploit is achievable remotely, and the vulnerability has been publicly disclosed.

The vulnerability affects TOTOLINK CP450 devices running firmware version 4.1.0cu.747. The flaw is located in the vsftpd component's configuration file /etc/vsftpd.conf. No other product or version information is provided in the CVE record.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the current exploitation probability is unknown, but the vulnerability has been publicly disclosed and may already be in use. Because it can be triggered remotely via standard vsftpd connections, the risk to exposed devices is significant. The vulnerability is not listed in the CISA KEV catalog, but its existence in a widely deployed consumer router model warrants immediate attention.