https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-49199.htmlhttps://patchthecve.com/cve/CVE-2026-49199.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.https://patchthecve.com/cve/CVE-2026-49198.htmlhttps://patchthecve.com/cve/CVE-2026-49198.htmlTue, 21 Jul 2026 12:10:00 +0000MEDIUM 4.9: Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.https://patchthecve.com/cve/CVE-2026-49197.htmlhttps://patchthecve.com/cve/CVE-2026-49197.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.https://patchthecve.com/cve/CVE-2026-49196.htmlhttps://patchthecve.com/cve/CVE-2026-49196.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.2: The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands.https://patchthecve.com/cve/CVE-2026-49195.htmlhttps://patchthecve.com/cve/CVE-2026-49195.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 8.8: Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands.