https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-31211.htmlhttps://patchthecve.com/cve/CVE-2022-31211.htmlWed, 17 Jun 2026 04:45:07 +0000CRITICAL 9.8: An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default.https://patchthecve.com/cve/CVE-2022-31210.htmlhttps://patchthecve.com/cve/CVE-2022-31210.htmlWed, 17 Jun 2026 04:45:07 +0000CRITICAL 9.8: An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts.https://patchthecve.com/cve/CVE-2022-31209.htmlhttps://patchthecve.com/cve/CVE-2022-31209.htmlWed, 17 Jun 2026 04:45:07 +0000CRITICAL 9.8: An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The firmware contains a potential buffer overflow by calling strcpy() without checking the string length beforehand.https://patchthecve.com/cve/CVE-2022-31208.htmlhttps://patchthecve.com/cve/CVE-2022-31208.htmlWed, 17 Jun 2026 04:45:07 +0000HIGH 8.8: An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmd_string URL parameter.