CVE-2026-126722 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The Rooxis RXR-12 Wi-Fi router ships an undocumented telnet daemon that starts when it receives a specially encrypted UDP packet. The packet is encrypted with a key and IV shared across all firmware, so an attacker can build it and gain root access over telnet with default credentials.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running a Rooxis RXR-12 router on firmware before 20260813_c2169ea5 is exposed, since the backdoor is in the firmware itself and the key is shared across all units. Networks that do not use this model can skip it. Whether the telnet service is reachable from the internet depends on how the router is exposed, which the sources do not say.
Not affected if firmware-updated, other-router-model
Who cares home-router, rooxis, rxr-12, telnet, wifi-router
20260813_c2169ea5/usr/bin/telnetd_startup on the device if you have shell access20260813_c2169ea5 or later, which removes the UDP listener; update through the router's local web interfaceRooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813_c2169ea5 removes the UDP listener entirely, and users can update through their local web interface.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.