https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2014-8356.htmlhttps://patchthecve.com/cve/CVE-2014-8356.htmlWed, 17 Jun 2026 00:16:36 +0000HIGH 8.8: The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference.https://patchthecve.com/cve/CVE-2019-10677.htmlhttps://patchthecve.com/cve/CVE-2019-10677.htmlWed, 17 Jun 2026 02:11:29 +0000MEDIUM 6.1: Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reghttps://patchthecve.com/cve/CVE-2014-9118.htmlhttps://patchthecve.com/cve/CVE-2014-9118.htmlWed, 17 Jun 2026 00:17:47 +0000HIGH 8.8: The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.https://patchthecve.com/cve/CVE-2014-8357.htmlhttps://patchthecve.com/cve/CVE-2014-8357.htmlWed, 17 Jun 2026 00:16:36 +0000HIGH 8.8: backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf.