{"id":"CVE-2026-11620","state":"PUBLISHED","title":"TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation","description":"A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.","publishedAt":"2026-06-09T02:45:10.490Z","updatedAt":"2026-06-09T16:00:26.436Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["TOTOLINK EX200"],"affected":[{"vendor":"TOTOLINK","product":"EX200","versions":[{"version":"4.0.3c.7646","status":"affected"}],"cpes":["cpe:2.3:o:totolink:ex200_firmware:*:*:*:*:*:*:*:*"],"modules":["vsftpd"]}],"references":["https://vuldb.com/vuln/369301","https://vuldb.com/vuln/369301/cti","https://vuldb.com/cve/CVE-2026-11620","https://vuldb.com/submit/834825","https://www.notion.so/TOTOLink-EX200-V4-0-3c-7646_B20201211-3671f5ba989080ccaa41d9f76fb1906b?source=copy_link","https://www.totolink.net/"],"weaknesses":["CWE-272","CWE-266"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/11xxx/CVE-2026-11620.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-11620","state":"PUBLISHED","datePublished":"2026-06-09T02:45:10.490Z","dateUpdated":"2026-06-09T16:00:26.436Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-06-08T20:14:12.689Z"},"containers":{"cna":{"title":"TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation","descriptions":[{"lang":"en","value":"A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks."}],"affected":[{"vendor":"TOTOLINK","product":"EX200","versions":[{"version":"4.0.3c.7646","status":"affected"}],"cpes":["cpe:2.3:o:totolink:ex200_firmware:*:*:*:*:*:*:*:*"],"modules":["vsftpd"]}],"references":[{"url":"https://vuldb.com/vuln/369301","name":"VDB-369301 | TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/369301/cti","name":"VDB-369301 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-11620","name":"CVE-2026-11620 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/834825","name":"Submit #834825 | TOTOLink EX200 V4.0.3c.7646 Misconfiguration","tags":["third-party-advisory"]},{"url":"https://www.notion.so/TOTOLink-EX200-V4-0-3c-7646_B20201211-3671f5ba989080ccaa41d9f76fb1906b?source=copy_link","tags":["exploit"]},{"url":"https://www.totolink.net/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-272","type":"CWE","lang":"en","description":"Least Privilege Violation"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-06-09T02:45:10.490Z"},"timeline":[{"time":"2026-06-08T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-06-08T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-06-08T22:19:16.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"L-14 (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-09T16:00:16.893844Z","id":"CVE-2026-11620","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-09T16:00:26.436Z"}}]}}}