CVE-2026-11620: TOTOLINK EX200 vsftpd Configuration Integrity Flaw (CVSS 5.3)

Technical summary

CVE-2026-11620 is a privilege escalation flaw affecting the vsftpd component in TOTOLIK EX200 4.0.3c.7646. The vulnerability exists in the /etc/vsftpd.conf file handling and stems from improper privilege management (CWE-266: Improper Privilege Management; CWE-272: Sensitive Information in Log Files). The issue permits remote, unauthenticated modification of FTP service configuration without user interaction (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N). This allows attackers to alter FTP daemon settings, potentially downgrading security controls or enabling unintended functionality. Public exploit code is available.

Business impact

Organizations deploying TOTOLINK EX200 routers as network gateways or edge devices face operational and security risks. An attacker could reconfigure the FTP daemon to permit weaker authentication, enable anonymous access, or modify file permissions, facilitating lateral movement, data exfiltration, or persistence mechanisms. While the CVSS score of 5.3 reflects integrity impact without confidentiality loss, the combination of remote exploitability, public proof-of-concept availability, and network-critical device placement elevates practical risk. Businesses relying on these routers should prioritize assessment and remediation to prevent unauthorized network access.

Affected systems

TOTOLINK EX200 routers running firmware version 4.0.3c.7646 are confirmed vulnerable. Organizations should verify whether this specific firmware version is deployed in production environments and check TOTOLIK's advisory for a complete list of affected firmware versions or model variants. Devices in DMZ or directly internet-facing positions present heightened exposure.

Exploitability

The vulnerability is highly exploitable. It requires no authentication (PR:N), no user interaction (UI:N), operates over the network (AV:N), and has low attack complexity (AC:L). Public exploit code is in circulation, lowering the barrier to weaponization. Automated scanning and exploitation attempts are likely already occurring. The absence of a KEV (Known Exploited Vulnerability) entry does not diminish the risk given public exploit availability and the straightforward attack path.

Remediation

Verify and deploy firmware updates from TOTOLIK that patch this vulnerability. Interim mitigation measures include: restricting network access to the EX200 management interface and FTP ports via firewall rules; disabling vsftpd/FTP services if not required for operational needs; and isolating vulnerable devices to trusted network segments. Monitor FTP access logs for suspicious configuration changes or unauthorized access attempts. Test patches in a non-production environment before wide deployment.

Patch guidance

Contact TOTOLIK support or check their security advisory page for the patched firmware version addressing CVE-2026-11620 for the EX200 model. Firmware patches should be applied through the device's web interface or command-line tools according to TOTOLIK's documented procedures. Ensure backups of current configurations are retained before upgrading. Verify successful patch installation by confirming the updated firmware version post-reboot and re-testing access controls.

Detection guidance

Monitor network traffic for unexpected connections to FTP ports (TCP 21) on affected EX200 devices, particularly from untrusted sources. Enable and review syslog or audit logs for modifications to /etc/vsftpd.conf, changes to FTP user permissions, or anomalous vsftpd daemon restarts. Implement network segmentation to baseline FTP traffic patterns and alert on deviations. Intrusion detection/prevention systems should be configured to flag attempts to access or modify the vsftpd configuration file remotely. Log all administrative access to device management interfaces.

Why prioritize this

This vulnerability warrants immediate attention despite its MEDIUM CVSS score due to four factors: (1) Remote unauthenticated exploitability on network-critical infrastructure; (2) Public availability of working exploits, indicating active threat landscape adoption; (3) Impact on device configuration integrity, which can enable secondary attacks; (4) Typical placement of routers in trusted network positions, making compromise a significant stepping stone for lateral movement. Organizations with internet-exposed EX200 routers should treat this as a short-term remediation priority.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the vulnerability's integrity impact without confidentiality or availability loss. However, this understates practical risk in security context: the attack surface (remote, unauthenticated, no interaction) is maximal, and the target (router configuration) is a high-value asset. The public exploit availability and the privilege-escalation nature of the flaw elevate operational risk beyond the numerical score. Organizations should apply additional context—network topology, internet exposure, and business criticality of affected devices—when determining urgency.

Frequently asked questions