https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-26793.htmlhttps://patchthecve.com/cve/CVE-2026-26793.htmlWed, 17 Jun 2026 10:26:20 +0000CRITICAL 9.8: GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.https://patchthecve.com/cve/CVE-2026-26795.htmlhttps://patchthecve.com/cve/CVE-2026-26795.htmlWed, 17 Jun 2026 10:26:20 +0000CRITICAL 9.8: GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.https://patchthecve.com/cve/CVE-2026-26794.htmlhttps://patchthecve.com/cve/CVE-2026-26794.htmlWed, 17 Jun 2026 10:26:20 +0000HIGH 8.8: GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request.https://patchthecve.com/cve/CVE-2026-26792.htmlhttps://patchthecve.com/cve/CVE-2026-26792.htmlWed, 17 Jun 2026 10:26:19 +0000CRITICAL 9.8: GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbithttps://patchthecve.com/cve/CVE-2026-26791.htmlhttps://patchthecve.com/cve/CVE-2026-26791.htmlWed, 17 Jun 2026 10:26:19 +0000CRITICAL 9.8: GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.