TOTOLINK N600R and X2000R FTP Service Least Privilege Violation Vulnerability

A critical misconfiguration vulnerability has been identified in TOTOLINK N600R and X2000R devices running version 1.0.0.1. The issue arises in the FTP service configuration file vsftpd.conf, where the chown_uploads property is enabled but the necessary chown_username property is not explicitly set, defaulting to root. This flaw allows remote attackers with anonymous FTP access to upload files that are automatically owned by the root user, potentially leading to unauthorized root-level control over the device.

Impact

Exploitation of this vulnerability could allow remote attackers with anonymous FTP access to gain root-level control over the affected device.