CVE-2025-8181highCWE-266CWE-272

CVE-2025-8181: fallo de gravedad alta en TOTOLINK N600R

TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear X2000R+ Monitorear N600R

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 1.1%
A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack remotely.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X
Productos afectados
TOTOLINK · N600RTOTOLINK · X2000R
CVEs relacionadas — TOTOLINK N600R

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-5504MEDIUMTOTOLINK X2000R formWsc command injectionEPSS 14.0%CVE-2025-5515MEDIUMTOTOLINK X2000R formMapDel command injectionEPSS 3.4%CVE-2025-9935MEDIUMTOTOLINK N600R cstecgi.cgi sub_4159F8 command injectionEPSS 2.7%CVE-2026-79912MEDIUMTOTOLINK N600R cstecgi.cgi getCurrentTime command injectionEPSS 2.1%CVE-2025-4496HIGHTOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflowEPSS 1.3%CVE-2026-79911CRITICALTOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflowEPSS 1.1%