| CVE / Issue | Description | Mitigation | |--------------------------------|--------------------------------------------------|------------------------------------------| | | Remote command injection via deviceinfo | Disable remote management; block port 37215 | | CVE-2016-20007 | Arbitrary file upload | Update firmware; disable WAN access | | Backdoor accounts | admin:admin , root:123456 (some firmware) | Change passwords; factory reset | | WPS PIN brute force | Allows Wi-Fi password recovery | Disable WPS completely |