https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-3991.htmlhttps://patchthecve.com/cve/CVE-2023-3991.htmlWed, 17 Jun 2026 06:15:38 +0000CRITICAL 10.0: An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2022-42484.htmlhttps://patchthecve.com/cve/CVE-2022-42484.htmlWed, 17 Jun 2026 05:05:01 +0000CRITICAL 9.8: An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2022-38451.htmlhttps://patchthecve.com/cve/CVE-2022-38451.htmlWed, 17 Jun 2026 04:56:37 +0000HIGH 7.5: A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2022-28665.htmlhttps://patchthecve.com/cve/CVE-2022-28665.htmlWed, 17 Jun 2026 04:38:48 +0000CRITICAL 9.8: A memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.The `freshtomato-arm` has a vulnerable URL-decoding feature that cahttps://patchthecve.com/cve/CVE-2022-28664.htmlhttps://patchthecve.com/cve/CVE-2022-28664.htmlWed, 17 Jun 2026 04:38:48 +0000CRITICAL 9.8: A memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.The `freshtomato-mips` has a vulnerable URL-decoding feature that c