https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-24849.htmlhttps://patchthecve.com/cve/CVE-2020-24849.htmlWed, 17 Jun 2026 03:06:06 +0000HIGH 8.8: A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-1731https://patchthecve.com/cve/CVE-2020-24848.htmlhttps://patchthecve.com/cve/CVE-2020-24848.htmlWed, 17 Jun 2026 03:06:06 +0000HIGH 7.8: FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.https://patchthecve.com/cve/CVE-2020-24847.htmlhttps://patchthecve.com/cve/CVE-2020-24847.htmlWed, 17 Jun 2026 03:06:06 +0000MEDIUM 4.3: A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticathttps://patchthecve.com/cve/CVE-2018-19168.htmlhttps://patchthecve.com/cve/CVE-2018-19168.htmlWed, 17 Jun 2026 01:48:54 +0000CRITICAL 9.8: Shell Metacharacter Injection in www/modules/save.php in FruityWifi (aka PatatasFritas/PatataWifi) through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted mod_name parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a validhttps://patchthecve.com/cve/CVE-2018-17317.htmlhttps://patchthecve.com/cve/CVE-2018-17317.htmlWed, 17 Jun 2026 01:45:39 +0000CRITICAL 9.8: FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action, io_in_iface, io_in_set, io_in_ip, io_in_mask, io_in_gw, io_out_iface, io_out_set, io_out_mask, io_out_gw, iface, or domain parameter to /ww