PT-2025-30293 · Totolink · Totolink A950Rg+2

Published 2025-07-21 · Updated 2025-07-22 · CVE-2025-44655

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLink A7100RU versions 7.4 TOTOLink A950RG versions 5.9 TOTOLink T10 versions 5.9

Description The chroot local user option is enabled in the vsftpd.conf file. This configuration could allow unauthorized access to system files, privilege escalation, or the use of a compromised server as a pivot point for internal network attacks.

Recommendations TOTOLink A7100RU version 7.4: Disable the chroot local user option in the vsftpd.conf file. TOTOLink A950RG version 5.9: Disable the chroot local user option in the vsftpd.conf file. TOTOLink T10 version 5.9: Disable the chroot local user option in the vsftpd.conf file.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-44655

Affected Products

Totolink A7100Ru

Totolink A950Rg

Totolink T10

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-44655 · Security Note
• https://osv.dev/vulnerability/CVE-2025-44655 · Vendor Advisory
• https://t.me/cveNotify/129878 · Telegram Post
• https://t.me/cvenotify/129707 · Telegram Post
• https://twitter.com/CVEnew/status/1947331044127953062 · Twitter Post
• https://gist.github.com/TPCchecker/d7306649f51ca25e22dd6532546a58f3 · Note
• http://totolink.com · Note