{"id":"CVE-2026-126720","kind":"vulnerability","aliases":["CVE-2026-126720"],"related":[],"title":"Rooxis RXR-12 Wi-Fi router: unauthenticated remote code execution as root","description":"Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface.","summary":"The Rooxis RXR-12 router's cloud_manage component passes a JSON field from its cloud server straight into popen(), so commands run as root. An attacker positioned on the network path can send a crafted response over cleartext HTTP and run arbitrary commands on the router.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Rooxis RXR-12","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","iot","rooxis-rxr-12","wi-fi-router"],"not_affected_if":["firmware-updated","other-router-models"],"how_to_check":"- Check the router's firmware version in its web interface; unknown otherwise\n- Confirm whether `/usr/bin/cloud_manage` is present on the device (unknown if the sources do not say how to reach it)","fix":"- Rooxis RXR-12: firmware `20260813_c2169ea5` or later, installed through the router's local web interface","status":"open","published_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:29:00+00:00","updated_at":"2026-11-11T17:29:00+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T17:29:00Z","model":"claude-haiku-5-5","output":{"fix":"- Rooxis RXR-12: firmware `20260813_c2169ea5` or later, installed through the router's local web interface","reach":"network","title":"Rooxis RXR-12 Wi-Fi router: unauthenticated remote code execution as root","impact":"high","summary":"The Rooxis RXR-12 router's cloud_manage component passes a JSON field from its cloud server straight into popen(), so commands run as root. An attacker positioned on the network path can send a crafted response over cleartext HTTP and run arbitrary commands on the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["rooxis-rxr-12","wi-fi-router","iot"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary commands as root on the router","analyst_note":"","how_to_check":"- Check the router's firmware version in its web interface; unknown otherwise\n- Confirm whether `/usr/bin/cloud_manage` is present on the device (unknown if the sources do not say how to reach it)","plain_action":"Update your Rooxis RXR-12 Wi-Fi router to firmware 20260813_c2169ea5 through its local web interface.","product_name":"Rooxis RXR-12","needs_analyst":false,"not_affected_if":["other-router-models","firmware-updated"],"who_is_affected":"Owners of Rooxis RXR-12 routers on firmware before 20260813_c2169ea5 are exposed, since the flaw is in the router's own cloud management service. An attacker must sit on the path between the router and its hard-coded cloud endpoint, because the traffic is cleartext HTTP. Networks without Rooxis RXR-12 hardware can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000794,"input_tokens":4639,"output_tokens":661,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-12':3A,22A,36B,82C '-126720':16A,19A '-2026':15A,18A '/usr/bin/cloud_manage':95C '12':28B '20260813':137C 'access':128C 'arbitrari':75B,110C 'attack':59B,120C 'c2169ea5':138C 'cleartext':71B,116C 'cloud':39B,48B,134C 'code':10A,91C,133C 'command':54B,76B,111C 'compon':41B 'contain':87C 'control':100C 'craft':68B 'cve':14A,17A 'diagnoseparamet':102C 'enabl':109C 'endpoint':135C 'execut':11A,92C,112C 'fi':6A,31B,85C 'field':45B,103C 'firmwar':136C 'fix':139C 'hard':132C 'hard-cod':131C 'http':72B,117C 'infrastructur':23B 'interfac':152C 'iot':24B 'json':44B,101C 'local':150C 'manag':40B 'network':63B 'on-path':123C 'pass':42B,105C 'path':64B,125C 'popen':52B,108C 'posit':60B,122C 'remot':9A,90C 'respons':69B 'root':13A,57B,114C 'rooxi':1A,26B,34B,80C 'rooxis':20A 'rooxis-rxr':25B 'router':7A,32B,37B,79B,86C,144C 'run':55B,74B 'rxr':2A,21A,27B,35B,81C 'send':66B 'server':49B,99C 'server-control':98C 'straight':50B 'unauthent':8A,89C 'unsanit':106C 'updat':147C 'vulner':93C,141C 'web':151C 'wi':5A,30B,84C 'wi-fi':4A,83C 'wi-fi-rout':29B","nicknames":[],"mitigations":[],"who_affected":"Owners of Rooxis RXR-12 routers on firmware before 20260813_c2169ea5 are exposed, since the flaw is in the router's own cloud management service. An attacker must sit on the path between the router and its hard-coded cloud endpoint, because the traffic is cleartext HTTP. Networks without Rooxis RXR-12 hardware can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Rooxis RXR-12 Wi-Fi router to firmware 20260813_c2169ea5 through its local web interface.","pkeys":["rooxisrxr12","rxr12"],"ptokens":["12","rooxis","rxr"],"labels":["high","infrastructure","iot","rooxisrxr12","vendor","wifirouter"],"campaign_type":null,"search_a":"'-12':3A,22A '-126720':16A,19A '-2026':15A,18A 'code':10A 'cve':14A,17A 'execut':11A 'fi':6A 'remot':9A 'root':13A 'rooxi':1A 'rooxis':20A 'router':7A 'rxr':2A,21A 'unauthent':8A 'wi':5A 'wi-fi':4A","search_b":"'-12':36B '12':28B 'arbitrari':75B 'attack':59B 'cleartext':71B 'cloud':39B,48B 'command':54B,76B 'compon':41B 'craft':68B 'fi':31B 'field':45B 'http':72B 'infrastructur':23B 'iot':24B 'json':44B 'manag':40B 'network':63B 'pass':42B 'path':64B 'popen':52B 'posit':60B 'respons':69B 'root':57B 'rooxi':26B,34B 'rooxis-rxr':25B 'router':32B,37B,79B 'run':55B,74B 'rxr':27B,35B 'send':66B 'server':49B 'straight':50B 'wi':30B 'wi-fi-rout':29B","search_c":"'-12':82C '/usr/bin/cloud_manage':95C '20260813':137C 'access':128C 'arbitrari':110C 'attack':120C 'c2169ea5':138C 'cleartext':116C 'cloud':134C 'code':91C,133C 'command':111C 'contain':87C 'control':100C 'diagnoseparamet':102C 'enabl':109C 'endpoint':135C 'execut':92C,112C 'fi':85C 'field':103C 'firmwar':136C 'fix':139C 'hard':132C 'hard-cod':131C 'http':117C 'interfac':152C 'json':101C 'local':150C 'on-path':123C 'pass':105C 'path':125C 'popen':108C 'posit':122C 'remot':90C 'root':114C 'rooxi':80C 'router':86C,144C 'rxr':81C 'server':99C 'server-control':98C 'unauthent':89C 'unsanit':106C 'updat':147C 'vulner':93C,141C 'web':151C 'wi':84C 'wi-fi':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126720","severity":null,"published_at":"2026-11-11T17:17:18+00:00","modified_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}