CVE-2025-8181
TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violation
- State
- Published
- Severity
- 8.6 High
- Published
- Jul 26, 2025
- Updated
- Jul 28, 2025
- Reserved
- Jul 25, 2025
Description
A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack remotely.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R | VulDB |
| 3.0 | 7.2 High | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R | VulDB |
| 2.0 | 8.3 High | AV:N/AC:L/Au:M/C:C/I:C/A:C/E:ND/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
N600RTOTOLINK |
|
X2000RTOTOLINK |
|
References
- VDB-317595 | TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violationvdb-entry
- VDB-317595 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #621966 | TOTOLINK N600R V4.3.0 Misconfigurationthird-party-advisory
- Submit #621968 | TOTOLINK X2000R V1.0.0 Misconfiguration (Duplicate)third-party-advisory
- https://www.notion.so/23a54a1113e780c08f3acca6a746d732related
- https://www.totolink.net/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.