HIGH🇵🇱 Wersja polska

CVE-2025-8181

CVSS 8.6v4.0pub. 2025-07-26upd. 2025-10-09

A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack remotely.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Totolink N600r

    HW
    Totolink
    all versions

  • Totolink N600r Firmware

    OS
    Totolink
    4.3.0

  • Totolink X2000r

    HW
    Totolink
    all versions

  • Totolink X2000r Firmware

    OS
    Totolink
    1.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-51390CRITICAL9.8PL ✓same product

Command injection w TOTOLINK N600R via parametr pin (WPS)

CVE-2025-46060CRITICAL9.8PL ✓same product

Buffer Overflow w TOTOLINK N600R umożliwiający zdalne wykonanie kodu

CVE-2025-22900CRITICAL9.8PL ✓same product

Stack overflow w Totolink N600R — podatność w funkcji setWanConfig

CVE-2024-22529CRITICAL9.8PL ✓same product

Command injection w TOTOLINK X2000R — podatność w obsłudze przesyłania plików

CVE-2023-51135CRITICAL9.8PL ✓same product

Stack overflow w TOTOLINK X2000R — podatność w funkcji formPasswordSetup