https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-4003.htmlhttps://patchthecve.com/cve/CVE-2022-4003.htmlWed, 17 Jun 2026 05:19:43 +0000LOW 2.7: A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request.https://patchthecve.com/cve/CVE-2022-4002.htmlhttps://patchthecve.com/cve/CVE-2022-4002.htmlWed, 17 Jun 2026 05:19:43 +0000HIGH 7.2: A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request.https://patchthecve.com/cve/CVE-2024-38281.htmlhttps://patchthecve.com/cve/CVE-2024-38281.htmlWed, 17 Jun 2026 07:39:51 +0000CRITICAL 9.8: An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.https://patchthecve.com/cve/CVE-2024-38280.htmlhttps://patchthecve.com/cve/CVE-2024-38280.htmlWed, 17 Jun 2026 07:39:51 +0000MEDIUM 4.6: An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.https://patchthecve.com/cve/CVE-2024-38279.htmlhttps://patchthecve.com/cve/CVE-2024-38279.htmlWed, 17 Jun 2026 07:39:51 +0000MEDIUM 4.6: The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.https://patchthecve.com/cve/CVE-2024-25360.htmlhttps://patchthecve.com/cve/CVE-2024-25360.htmlWed, 17 Jun 2026 07:15:54 +0000MEDIUM 5.3: A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to device_web_ip.https://patchthecve.com/cve/CVE-2024-23630.htmlhttps://patchthecve.com/cve/CVE-2024-23630.htmlWed, 17 Jun 2026 07:13:16 +0000CRITICAL 9.0: An arbitrary firmware upload vulnerability exists in the Motorola MR2600. An attacker can exploit this vulnerability to achieve code execution on the device. Authentication is required, however can be bypassed.https://patchthecve.com/cve/CVE-2024-23629.htmlhttps://patchthecve.com/cve/CVE-2024-23629.htmlWed, 17 Jun 2026 07:13:15 +0000CRITICAL 9.6: An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs and retrieve sensitive information. https://patchthecve.com/cve/CVE-2024-23628.htmlhttps://patchthecve.com/cve/CVE-2024-23628.htmlWed, 17 Jun 2026 07:13:15 +0000CRITICAL 9.0: A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.https://patchthecve.com/cve/CVE-2024-23627.htmlhttps://patchthecve.com/cve/CVE-2024-23627.htmlWed, 17 Jun 2026 07:13:15 +0000CRITICAL 9.0: A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.https://patchthecve.com/cve/CVE-2024-23626.htmlhttps://patchthecve.com/cve/CVE-2024-23626.htmlWed, 17 Jun 2026 07:13:15 +0000CRITICAL 9.0: A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed. https://patchthecve.com/cve/CVE-2022-3681.htmlhttps://patchthecve.com/cve/CVE-2022-3681.htmlWed, 17 Jun 2026 05:00:00 +0000MEDIUM 6.5: A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless network to successfully brute force the WPS pin, potentially allowing them unauthorized access to a wireless network. https://patchthecve.com/cve/CVE-2022-27813.htmlhttps://patchthecve.com/cve/CVE-2022-27813.htmlWed, 17 Jun 2026 04:37:33 +0000HIGH 8.1: Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the firmwahttps://patchthecve.com/cve/CVE-2022-26943.htmlhttps://patchthecve.com/cve/CVE-2022-26943.htmlWed, 17 Jun 2026 04:36:12 +0000HIGH 8.8: The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two attacks. First, due to the limited boottihttps://patchthecve.com/cve/CVE-2022-26942.htmlhttps://patchthecve.com/cve/CVE-2022-26942.htmlWed, 17 Jun 2026 04:36:12 +0000HIGH 8.2: The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisorhttps://patchthecve.com/cve/CVE-2022-26941.htmlhttps://patchthecve.com/cve/CVE-2022-26941.htmlWed, 17 Jun 2026 04:36:12 +0000CRITICAL 9.6: A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the teds_app bihttps://patchthecve.com/cve/CVE-2022-3407.htmlhttps://patchthecve.com/cve/CVE-2022-3407.htmlWed, 17 Jun 2026 04:59:28 +0000MEDIUM 4.9: I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection with the host PC, if the user originates a call on the device, then the device's modem may reset and cause the phone call to not succeed. This may block the user from dialing emergenc