A flaw in the vsftpd configuration file /etc/vsftpd.conf on TOTOLINK EX200 creates a least privilege violation, enabling an attacker to alter the configuration in a way that elevates privileges beyond the intended level. This could permit execution of commands with higher rights, potentially compromising the device entirely.

The vulnerability afflicts the TOTOLINK EX200 router, specifically firmware version 4.0.3c.7646. It affects the vsftpd component, so any device running this firmware and exposing its FTP service is at risk.

The CVSS score of 6.9 indicates a substantial risk. No EPSS score is available, but the public release of an exploit and confirmation that the attack is remotely launchable raise the likelihood of real‑world exploitation. While the flaw is not listed in the CISA KEV catalog, defenders should treat it with high priority because it can be abused by connecting to the FTP service and modifying the configuration file, assuming the device permits such writes.