https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-3073.htmlhttps://patchthecve.com/cve/CVE-2022-3073.htmlWed, 17 Jun 2026 04:58:46 +0000MEDIUM 6.1: Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment.https://patchthecve.com/cve/CVE-2021-33539.htmlhttps://patchthecve.com/cve/CVE-2021-33539.htmlWed, 17 Jun 2026 03:54:45 +0000HIGH 7.2: In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially configured device hostname can cause the device to interpret selected remote traffic as local traffic, resulting in a bypass of web authenticahttps://patchthecve.com/cve/CVE-2021-33538.htmlhttps://patchthecve.com/cve/CVE-2021-33538.htmlWed, 17 Jun 2026 03:54:44 +0000HIGH 8.8: In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access tohttps://patchthecve.com/cve/CVE-2021-33537.htmlhttps://patchthecve.com/cve/CVE-2021-33537.htmlWed, 17 Jun 2026 03:54:44 +0000HIGH 8.8: In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality. A specially crafted user name entry can cause an overflow of an error message buffer, resulting in remote code execution. An attachttps://patchthecve.com/cve/CVE-2021-33536.htmlhttps://patchthecve.com/cve/CVE-2021-33536.htmlWed, 17 Jun 2026 03:54:44 +0000HIGH 7.5: In Weidmueller Industrial WLAN devices in multiple versions an exploitable denial-of-service vulnerability exists in ServiceAgent functionality. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can senhttps://patchthecve.com/cve/CVE-2021-33535.htmlhttps://patchthecve.com/cve/CVE-2021-33535.htmlWed, 17 Jun 2026 03:54:44 +0000HIGH 8.8: In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can senhttps://patchthecve.com/cve/CVE-2021-33534.htmlhttps://patchthecve.com/cve/CVE-2021-33534.htmlWed, 17 Jun 2026 03:54:44 +0000HIGH 7.2: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. Ahttps://patchthecve.com/cve/CVE-2021-33533.htmlhttps://patchthecve.com/cve/CVE-2021-33533.htmlWed, 17 Jun 2026 03:54:44 +0000HIGH 8.8: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. https://patchthecve.com/cve/CVE-2021-33532.htmlhttps://patchthecve.com/cve/CVE-2021-33532.htmlWed, 17 Jun 2026 03:54:44 +0000HIGH 8.8: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the dehttps://patchthecve.com/cve/CVE-2021-33531.htmlhttps://patchthecve.com/cve/CVE-2021-33531.htmlWed, 17 Jun 2026 03:54:43 +0000HIGH 8.8: In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts. An attacker can https://patchthecve.com/cve/CVE-2021-33530.htmlhttps://patchthecve.com/cve/CVE-2021-33530.htmlWed, 17 Jun 2026 03:54:43 +0000HIGH 8.8: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the devices. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote control ohttps://patchthecve.com/cve/CVE-2021-33529.htmlhttps://patchthecve.com/cve/CVE-2021-33529.htmlWed, 17 Jun 2026 03:54:43 +0000HIGH 7.5: In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryption of captured traffic across the network from or to the device.https://patchthecve.com/cve/CVE-2021-33528.htmlhttps://patchthecve.com/cve/CVE-2021-33528.htmlWed, 17 Jun 2026 03:54:43 +0000HIGH 8.8: In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker cahttps://patchthecve.com/cve/CVE-2021-20999.htmlhttps://patchthecve.com/cve/CVE-2021-20999.htmlWed, 17 Jun 2026 03:34:37 +0000CRITICAL 9.4: In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped.https://patchthecve.com/cve/CVE-2020-12525.htmlhttps://patchthecve.com/cve/CVE-2020-12525.htmlWed, 17 Jun 2026 02:51:58 +0000HIGH 7.3: M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.