Ha! apt-get had 17 vulnerabilities in the last few years, two of them with very high severity score, easily exploitable [0]. For example: CVE-2019-3462 Incorre

Ha! apt-get had 17 vulnerabilities in the last few years, two of them with very high severity score, easily exploitable [0]. For example: CVE-2019-3462 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-23/product_id-17236/Debian-APT.html https://www.cvedetails.com/vulnerability-list/vendor_id-23/p... Edit: many of the CVEs for apt-get are in the "bad pki" class, all of them are "severe" as they allow malicious code execution: CVE-2009-1358 apt-get does not check for the correct error code from gpgv CVE-2011-1829 APT does not properly validate inline GPG signatures CVE-2011-3634 APt accepts connections when the certificate host name fails validation CVE-2014-0478 APT does not properly validate source packages, allow installation of Trojan horse packages by removing the Release signature. etc etc. Facts of life: all software contain an uncountable number of severe vulnerabilities. It is unfair to single-out openwrt IMHO.