In Linksys EA6350 firmware version 2.1.2, the vsftpd service configuration dynamically enables the chroot_local_user option. This setting may inadvertently allow users to escape restricted directories, leading to unauthorized access to system files and potential privilege escalation. Additionally, an attacker exploiting this vulnerability could leverage the compromised device as a pivot point to launch further attacks within the internal network. The vulnerability is tracked as CVE-2025-44657 with a CVSS v3.1 base score of 3.9 (low severity). No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

The vulnerability could allow a local attacker with limited privileges to gain unauthorized access to system files or escalate privileges on the affected device. It may also enable the compromised device to be used as a pivot point for further internal network attacks. However, the impact is limited by the requirement for local access and user interaction, reflected in the low CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the device and monitor for suspicious activity related to vsftpd. Avoid exposing the device to untrusted users to reduce risk.