https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-29656.htmlhttps://patchthecve.com/cve/CVE-2020-29656.htmlWed, 17 Jun 2026 03:11:34 +0000HIGH 7.5: An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language makes it possible to reach "unknown functionality" in a "known to be easy" manner via an unshttps://patchthecve.com/cve/CVE-2020-29655.htmlhttps://patchthecve.com/cve/CVE-2020-29655.htmlWed, 17 Jun 2026 03:11:34 +0000HIGH 7.5: An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. Accessing Main_Login.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp will redirect to the login site, which will show the value of the parameter productname within the title. An attacker might be able to influhttps://patchthecve.com/cve/CVE-2018-18320.htmlhttps://patchthecve.com/cve/CVE-2018-18320.htmlWed, 17 Jun 2026 01:46:59 +0000CRITICAL 9.8: An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code https://patchthecve.com/cve/CVE-2018-18319.htmlhttps://patchthecve.com/cve/CVE-2018-18319.htmlWed, 17 Jun 2026 01:46:59 +0000CRITICAL 9.8: An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only https://patchthecve.com/cve/CVE-2018-9285.htmlhttps://patchthecve.com/cve/CVE-2018-9285.htmlWed, 17 Jun 2026 02:06:21 +0000CRITICAL 9.8: Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices before 3.0.0.4.382.39935; RT-AC87U and RT-AC3200 devices before 3.0.0.4.382.50010; and RT-AC5300 devices before 3.0.0.4.384.20https://patchthecve.com/cve/CVE-2017-11420.htmlhttps://patchthecve.com/cve/CVE-2017-11420.htmlWed, 17 Jun 2026 01:01:47 +0000CRITICAL 9.8: Stack-based buffer overflow in ASUS_Discovery.c in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-https://patchthecve.com/cve/CVE-2017-11345.htmlhttps://patchthecve.com/cve/CVE-2017-11345.htmlWed, 17 Jun 2026 01:01:39 +0000HIGH 7.8: Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AChttps://patchthecve.com/cve/CVE-2017-11344.htmlhttps://patchthecve.com/cve/CVE-2017-11344.htmlWed, 17 Jun 2026 01:01:39 +0000HIGH 7.8: Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_A