# CVE-2026-11620: TOTOLINK EX200 least privilege violation in vsftpd.conf

Source: https://junglewise.ai/threats/cve-2026-11620-totolink-ex200-least-privilege-violation-in-vsftpd-conf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-11620 · Severity: medium · CVSS 5.3 · Published 2026-06-09

A security vulnerability exists in the TOTOLINK EX200 wireless range extender. The device's file transfer service (FTP) is misconfigured, which could allow an unauthorized person to perform actions they should not be allowed to do. This could potentially lead to unauthorized changes to the device's settings or files, impacting the integrity of the network equipment.

Technologies: [TOTOLINK EX200](https://junglewise.ai/threats/technologies/ex200). Vendors: [TOTOLINK](https://junglewise.ai/threats/vendors/totolink).

## Quick answers

**Is CVE-2026-11620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11620 being exploited in the wild.

**How severe is CVE-2026-11620?** Medium severity, with a CVSS score of 5.3, published 9 June 2026.

**Which products and versions are affected?** TOTOLINK EX200 4.0.3c.7646.

**Is there a fix for CVE-2026-11620?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11620 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-11620?** Check whether you run TOTOLINK EX200 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A least privilege violation (CWE-272) exists in the TOTOLINK EX200 firmware version 4.0.3c.7646. The vulnerability is rooted in the configuration of the vsftpd service, specifically within the /etc/vsftpd.conf file. A remote, unauthenticated attacker can exploit this misconfiguration to bypass intended privilege restrictions. While the specific function affected is not fully detailed, the flaw allows for unauthorized manipulation of the system's integrity. A public exploit has been released, increasing the risk of active exploitation.

## Affected products

- TOTOLINK EX200 4.0.3c.7646

## Timeline

- 2026-06-09: advisory: NVD publication date
- 2026-06-09: disclosed: Public disclosure of the vulnerability and exploit

## References

- [https://vuldb.com/cve/CVE-2026-11620](https://vuldb.com/cve/CVE-2026-11620)
- [https://vuldb.com/submit/834825](https://vuldb.com/submit/834825)
- [https://vuldb.com/vuln/369301](https://vuldb.com/vuln/369301)
- [https://vuldb.com/vuln/369301/cti](https://vuldb.com/vuln/369301/cti)
- [https://www.notion.so/TOTOLink-EX200-V4-0-3c-7646_B20201211-3671f5ba989080ccaa41d9f76fb1906b?source=copy_link](https://www.notion.so/TOTOLink-EX200-V4-0-3c-7646_B20201211-3671f5ba989080ccaa41d9f76fb1906b?source=copy_link)
- [https://www.totolink.net/](https://www.totolink.net/)

## Related threats

- [TOTOLINK EX200 stack-based buffer overflow in setWiFiAclAddConfig](https://junglewise.ai/threats/cve-2026-114383-a-weakness-has-been-identified-in-totolink-ex200-5-2-3c-7200)
- [TOTOLINK EX200 stack buffer overflow in setStaticDhcpConfig](https://junglewise.ai/threats/cve-2026-114382-a-security-flaw-has-been-discovered-in-totolink-ex200-5-2-3c)
- [TOTOLINK multiple devices privilege escalation in Web Interface](https://junglewise.ai/threats/cve-2026-15271-totolink-multiple-devices-privilege-escalation-in-web-interface)