https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-36267.htmlhttps://patchthecve.com/cve/CVE-2022-36267.htmlWed, 17 Jun 2026 04:53:09 +0000CRITICAL 9.8: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execuhttps://patchthecve.com/cve/CVE-2022-36266.htmlhttps://patchthecve.com/cve/CVE-2022-36266.htmlWed, 17 Jun 2026 04:53:08 +0000MEDIUM 6.1: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if the user is authenticated, a malicious actor can craft a specific request on the login.cgi endpoint that contains a base32 encoded XSS payloadhttps://patchthecve.com/cve/CVE-2022-36265.htmlhttps://patchthecve.com/cve/CVE-2022-36265.htmlWed, 17 Jun 2026 04:53:08 +0000HIGH 7.2: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Hidden system command web page. After performing a reverse engineering of the firmware, it was discovered that a hidden page not listed in the administration management interface allows a user to execute Linux commands on the device https://patchthecve.com/cve/CVE-2022-36264.htmlhttps://patchthecve.com/cve/CVE-2022-36264.htmlWed, 17 Jun 2026 04:53:08 +0000CRITICAL 9.1: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename and