CVE-2026-11620

5.5 mediumEPSS 0.3%

Medium (5.5). EPSS 0.3% chance of exploitation in the next 30 days.

A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWEs: CWE-266, CWE-272
Published: 2026-06-09
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://vuldb.com/cve/CVE-2026-11620
https://vuldb.com/submit/834825
https://vuldb.com/vuln/369301
https://vuldb.com/vuln/369301/cti
https://www.notion.so/TOTOLink-EX200-V4-0-3c-7646_B20201211-3671f5ba989080ccaa41d9f76fb1906b?source=copy_link

Check your stack JSON