CVE-2026-11554

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege violation. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266 CWE-272

Affected software

Vendor	Product	Versions
TOTOLINK	CP450	4.1.0cu.747

References

Timeline

Published: Jun 8, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1155417.2HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated CVE-2026-1155468.1Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session CVE-2026-1155479.1An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. CVE-2026-1155487.2The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_U CVE-2026-115557.5A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the CVE-2026-1155546.4IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated u CVE-2026-1155579.4Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation CVE-2026-1155596.3IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arri CVE-2026-115568.8A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac CVE-2026-1155675.8Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick CVE-2026-1155693.3Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest proj CVE-2026-115578.8A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit