CVE-2026-77053 (CVSS 4.0 8.7) is the most consequential: the firmware ships with authentication disabled and its management web API listens on all network interfaces, so an unauthenticated attacker on the network can take full control of the device — causing denial of service, changing configuration and operating the physical circuits wired to it.