CVE-2026-126722: OS Command Injection

Published Nov 11, 2026

Updated

Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetdstartup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813c2169ea5 removes the UDP listener entirely, and users can update through their local web interface.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Rooxis RXR-12 to a version that resolves this vulnerability.
Fixed in 20260813_c2169ea5

Event History

Nov 11, 2026

CVE Published

via MITRE·04:41 PM

Data Sourced

via MITRE·04:41 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker who can send the required precomputed AES-128-CBC magic packet to the router's UDP listener can enable telnet. Successful exploitation then provides remote root access using default credentials.

Is the telnet service exposed by default?

The backdoor daemon includes a UDP listener that activates telnet only after it receives the magic packet. The description does not state whether that UDP listener is reachable from the internet by default or limited to local networks.

What should I do if I cannot update immediately?

Restrict access to the router's UDP listener and prevent untrusted hosts from reaching the device over the network. Updating to firmware 20260813_c2169ea5 is the stated remediation because it removes the UDP listener entirely.

How can I determine whether the remediation is installed?

Verify that the router is running firmware 20260813_c2169ea5. That firmware removes the UDP listener used to activate the undocumented telnet service.

CVE-2026-126722: OS Command Injection

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Is the telnet service exposed by default?

What should I do if I cannot update immediately?

How can I determine whether the remediation is installed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is the telnet service exposed by default?

What should I do if I cannot update immediately?

How can I determine whether the remediation is installed?