The vulnerability CVE-2025-44655 exists in TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9 routers due to the chroot_local_user option enabled in the vsftpd.conf file. This setting can lead to unauthorized system file access and privilege escalation, potentially allowing attackers to leverage the compromised router as a pivot for further internal network attacks. The CVSS 3.1 base score is 9.8, indicating a critical risk with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation could result in unauthorized access to sensitive system files, privilege escalation on the affected router, and the ability for attackers to use the compromised device as a pivot point to launch further attacks within the internal network. This poses a critical risk to network security and device integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No official patch or temporary fix information is currently provided.