Totolink CP450 vulnerabilities

3 CVEs affecting Totolink CP450, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85031, published 2026-09-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-85031, published 2026-09-03. Critical severity, CVSS 9.9. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer…
CVE-2026-15271, published 2026-07-09. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file…
CVE-2026-11554, published 2026-06-08. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege…