CVE-2026-11620

MediumCVSS 5.3/10Last modified Jul 23, 2026

Description

A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266CWE-272

Affected software

VendorProductVersions
TOTOLINKEX2004.0.3c.7646

References

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-116214.7A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-mCVE-2026-116227.5A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The CVE-2026-116234.5A security vulnerability has been detected in tmux up to 3.6a. Affected is the function image_free of the file image.c. Such manipulation leCVE-2026-116249.4The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNCVE-2026-116257.5Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forCVE-2026-116265.4CleanWipe Removal Tool (macOS), prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of isCVE-2026-116286.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially exploit heap corruption via physicaCVE-2026-116298.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafCVE-2026-11634.1An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate activeCVE-2026-116308.8Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via aCVE-2026-116318.3Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer procesCVE-2026-116327.5Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI