CVE-2025-8181: totolink n600r_firmware Incorrect Privilege Assignment
Vulnerability summary
CVE-2025-8181 is a high (CVSS 8.6) Incorrect Privilege Assignment vulnerability in totolink n600r_firmware. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 26-07-2025PublishedVulnerability first disclosed.
- 28-07-2025Last modifiedVulnerability information updated.
Description
A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack remotely.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST8.6HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.3HighAV:N/AC:L/Au:M/C:C/I:C/A:C
EPSS trend
Probability
1.04%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
+0.13 pp
From 0.91% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (notion.so)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-272Least Privilege ViolationThe elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
Affected systems
Totolink2 products
- n600r_firmware1.0.0.1 | 4.3.0
- x2000r_firmware1.0.0.1 | 1.0.0
1 vendor · 2 products
References
6 links- www.totolink.netProduct