https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-12777.htmlhttps://patchthecve.com/cve/CVE-2019-12777.htmlWed, 17 Jun 2026 02:15:26 +0000HIGH 7.8: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as default by the underlying operating system) with highly insecure read, write, and execute directory perhttps://patchthecve.com/cve/CVE-2019-12776.htmlhttps://patchthecve.com/cve/CVE-2019-12776.htmlWed, 17 Jun 2026 02:15:25 +0000CRITICAL 9.8: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocate_revB scripts copies the hardcoded key to https://patchthecve.com/cve/CVE-2019-12775.htmlhttps://patchthecve.com/cve/CVE-2019-12775.htmlWed, 17 Jun 2026 02:15:25 +0000HIGH 8.8: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. (Furthermore, the user account that controls the web applicathttps://patchthecve.com/cve/CVE-2019-12774.htmlhttps://patchthecve.com/cve/CVE-2019-12774.htmlWed, 17 Jun 2026 02:15:25 +0000MEDIUM 6.1: A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description fihttps://patchthecve.com/cve/CVE-2019-6542.htmlhttps://patchthecve.com/cve/CVE-2019-6542.htmlWed, 17 Jun 2026 02:39:13 +0000HIGH 7.5: ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated user to initiate a remote reboot, which may be used to cause a denial of service condition.