https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-11968.htmlhttps://patchthecve.com/cve/CVE-2020-11968.htmlWed, 17 Jun 2026 02:51:09 +0000HIGH 7.5: In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting https://patchthecve.com/cve/CVE-2020-11967.htmlhttps://patchthecve.com/cve/CVE-2020-11967.htmlWed, 17 Jun 2026 02:51:09 +0000CRITICAL 9.8: In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has ahttps://patchthecve.com/cve/CVE-2020-11966.htmlhttps://patchthecve.com/cve/CVE-2020-11966.htmlWed, 17 Jun 2026 02:51:08 +0000CRITICAL 9.8: In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a requhttps://patchthecve.com/cve/CVE-2020-11965.htmlhttps://patchthecve.com/cve/CVE-2020-11965.htmlWed, 17 Jun 2026 02:51:08 +0000CRITICAL 9.8: In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for https://patchthecve.com/cve/CVE-2020-11964.htmlhttps://patchthecve.com/cve/CVE-2020-11964.htmlWed, 17 Jun 2026 02:51:08 +0000HIGH 7.5: In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a rhttps://patchthecve.com/cve/CVE-2020-11963.htmlhttps://patchthecve.com/cve/CVE-2020-11963.htmlWed, 17 Jun 2026 02:51:08 +0000CRITICAL 9.8: IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration