CVE-2026-126720: OS Command Injection
Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloudmanage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rooxis RXR-12to a version that resolves this vulnerability.Fixed in 20260813_c2169ea5
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Routers running firmware older than 20260813_c2169ea5 are exposed when they communicate with the hard-coded cloud endpoint over cleartext HTTP. An attacker must be positioned on the network path to that endpoint and have access to the hard-coded endpoint.
What level of access can an attacker obtain?
Successful exploitation allows arbitrary commands to be executed as root through the cloud_manage component.
How can I remediate this issue?
Update the router firmware to 20260813_c2169ea5 using the local web interface.