https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-41737.htmlhttps://patchthecve.com/cve/CVE-2025-41737.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.5: Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.https://patchthecve.com/cve/CVE-2025-41736.htmlhttps://patchthecve.com/cve/CVE-2025-41736.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.8: A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.https://patchthecve.com/cve/CVE-2025-41735.htmlhttps://patchthecve.com/cve/CVE-2025-41735.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.8: A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.https://patchthecve.com/cve/CVE-2025-41734.htmlhttps://patchthecve.com/cve/CVE-2025-41734.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.8: An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.https://patchthecve.com/cve/CVE-2025-41733.htmlhttps://patchthecve.com/cve/CVE-2025-41733.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.8: The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.