CVE-2026-126723: OS Command Injection

Published Nov 11, 2026

Updated

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI whitelist RPC handler (/usr/lib/lua/luci/data/whitelistplt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Rooxis RXR-12 firmware to a version that resolves this vulnerability.
Fixed in 20260813_c2169ea5

Event History

Nov 11, 2026

CVE Published

via MITRE·04:41 PM

Data Sourced

via MITRE·04:41 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be authenticated to the router's LuCI interface and able to submit a malformed MAC address to the white_list RPC handler.

What privileges could successful exploitation provide?

Successful command injection results in command execution as root on the router.

Which firmware version fixes the issue?

Firmware 20260813_c2169ea5 fixes the vulnerability. The update can be installed through the router's local web interface.

CVE-2026-126723: OS Command Injection

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What privileges could successful exploitation provide?

Which firmware version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What privileges could successful exploitation provide?

Which firmware version fixes the issue?