CVE-2025-44655: Critical severity TOTOLINK A7100RU vulnerability
In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chrootlocaluser option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
For TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, set 'chroot_local_user' to disabled in vsftpd.conf (it is currently enabled) to reduce risk of unauthorized access to system files, privilege escalation, and pivoting for internal network attacks.
vsftpd.conf chroot_local_user = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-44655?
CVE-2025-44655 is considered to be a high severity vulnerability due to the potential for unauthorized access and privilege escalation.
How do I fix CVE-2025-44655?
To mitigate CVE-2025-44655, it is recommended to disable the chroot_local_user option in the vsftpd.conf configuration.
What products are affected by CVE-2025-44655?
CVE-2025-44655 affects the TOTOLink A7100RU, A950RG, and T10 models.
What potential risks are associated with CVE-2025-44655?
CVE-2025-44655 could lead to unauthorized access to system files and could turn a compromised server into a pivot point for internal network attacks.
Is there a workaround for CVE-2025-44655?
A possible workaround for CVE-2025-44655 is to restrict user access permissions and strengthen overall network security.