CVE-2026-126724: Security vulnerability
Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rooxis RXR-12 firmwareto a version that resolves this vulnerability.Fixed in 20260813_c2169ea5
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the router's SSH service or physical access to its local console. Because the backdoor uses a firmware-wide default password rather than a device-specific secret, no prior access or unique credentials are required.
Which firmware fixes the issue?
Firmware 20260813_c2169ea5 removes the dg account from the shipped root filesystem and disables root password authentication in SSH.
How can I apply the available fix?
The router can be updated through its local web interface.