ROOXIS RXR-12 · CVE-2026-126720 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The Rooxis RXR-12 router's cloud_manage component passes a JSON field from its cloud server straight into popen(), so commands run as root. An attacker positioned on the network path can send a crafted response over cleartext HTTP and run arbitrary commands on the router.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Owners of Rooxis RXR-12 routers on firmware before 20260813_c2169ea5 are exposed, since the flaw is in the router's own cloud management service. An attacker must sit on the path between the router and its hard-coded cloud endpoint, because the traffic is cleartext HTTP. Networks without Rooxis RXR-12 hardware can skip it.
Not affected if firmware-updated, other-router-models
Who cares iot, rooxis-rxr-12, wi-fi-router
/usr/bin/cloud_manage is present on the device (unknown if the sources do not say how to reach it)20260813_c2169ea5 or later, installed through the router's local web interfaceRooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.