{"id":"CVE-2026-126722","kind":"vulnerability","aliases":["CVE-2026-126722"],"related":[],"title":"Rooxis RXR-12 router: hidden magic packet enables telnet with root access","description":"Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813_c2169ea5 removes the UDP listener entirely, and users can update through their local web interface.","summary":"The Rooxis RXR-12 Wi-Fi router ships an undocumented telnet daemon that starts when it receives a specially encrypted UDP packet. The packet is encrypted with a key and IV shared across all firmware, so an attacker can build it and gain root access over telnet with default credentials.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-router","infrastructure","rooxis","rxr-12","telnet","wifi-router"],"not_affected_if":["firmware-updated","other-router-model"],"how_to_check":"- Check the router's firmware version in its local web interface and compare it with `20260813_c2169ea5`\n- Look for the file `/usr/bin/telnetd_startup` on the device if you have shell access\n- Check whether telnet (port 23) answers on the router from the local network","fix":"- Update the RXR-12 to firmware `20260813_c2169ea5` or later, which removes the UDP listener; update through the router's local web interface","status":"open","published_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:28:57+00:00","updated_at":"2026-11-11T17:28:57+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T17:28:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the RXR-12 to firmware `20260813_c2169ea5` or later, which removes the UDP listener; update through the router's local web interface","reach":"network","title":"Rooxis RXR-12 router: hidden magic packet enables telnet with root access","impact":"high","summary":"The Rooxis RXR-12 Wi-Fi router ships an undocumented telnet daemon that starts when it receives a specially encrypted UDP packet. The packet is encrypted with a key and IV shared across all firmware, so an attacker can build it and gain root access over telnet with default credentials.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["rooxis","rxr-12","wifi-router","home-router","telnet"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gets root shell on the router remotely.","analyst_note":"","how_to_check":"- Check the router's firmware version in its local web interface and compare it with `20260813_c2169ea5`\n- Look for the file `/usr/bin/telnetd_startup` on the device if you have shell access\n- Check whether telnet (port 23) answers on the router from the local network","plain_action":"Update your Rooxis RXR-12 router to firmware 20260813_c2169ea5 through its local web interface.","product_name":"","needs_analyst":false,"not_affected_if":["other-router-model","firmware-updated"],"who_is_affected":"Anyone running a Rooxis RXR-12 router on firmware before 20260813_c2169ea5 is exposed, since the backdoor is in the firmware itself and the key is shared across all units. Networks that do not use this model can skip it. Whether the telnet service is reachable from the internet depends on how the router is exposed, which the sources do not say.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000787,"input_tokens":4614,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-12':3A,25B,33B,83C '-126722':15A,18A '-128':102C '-2026':14A,17A '/usr/bin/telnetd_startup':94C '20260813':126C 'access':12A,75B,124C 'across':63B 'ae':101C 'attack':68B 'backdoor':92C 'build':70B 'c2169ea5':127C 'cbc':103C 'contain':88C 'credenti':80B,120C 'cve':13A,16A 'daemon':42B,93C 'default':79B,119C 'enabl':8A,115C 'encrypt':50B,56B 'entir':132C 'fi':36B,86C 'firmwar':65B,109C,125C 'firmware-wid':108C 'gain':73B 'hidden':5A 'home':20B 'home-rout':19B 'infrastructur':22B 'interfac':141C 'iv':61B,114C 'key':59B,112C 'listen':131C 'local':139C 'magic':6A,104C 'packet':7A,52B,54B,105C 'precomput':100C 'provid':121C 'receipt':97C 'receiv':47B 'remot':122C 'remov':128C 'root':11A,74B,123C 'rooxi':1A,23B,31B,81C 'router':4A,21B,29B,37B,87C 'rxr':2A,24B,32B,82C 'servic':117C 'share':62B 'ship':38B 'special':49B 'start':44B 'static':111C 'telnet':9A,26B,41B,77B,91C,116C 'udp':51B,130C 'undocu':40B,90C 'updat':136C 'upon':96C 'use':106C 'user':134C 'web':140C 'wi':35B,85C 'wi-fi':34B,84C 'wide':110C 'wifi':28B 'wifi-rout':27B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Rooxis RXR-12 router on firmware before 20260813_c2169ea5 is exposed, since the backdoor is in the firmware itself and the key is shared across all units. Networks that do not use this model can skip it. Whether the telnet service is reachable from the internet depends on how the router is exposed, which the sources do not say.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Rooxis RXR-12 router to firmware 20260813_c2169ea5 through its local web interface.","pkeys":[],"ptokens":[],"labels":["critical","homerouter","infrastructure","rooxis","rxr12","telnet","wifirouter"],"campaign_type":null,"search_a":"'-12':3A '-126722':15A,18A '-2026':14A,17A 'access':12A 'cve':13A,16A 'enabl':8A 'hidden':5A 'magic':6A 'packet':7A 'root':11A 'rooxi':1A 'router':4A 'rxr':2A 'telnet':9A","search_b":"'-12':25B,33B 'access':75B 'across':63B 'attack':68B 'build':70B 'credenti':80B 'daemon':42B 'default':79B 'encrypt':50B,56B 'fi':36B 'firmwar':65B 'gain':73B 'home':20B 'home-rout':19B 'infrastructur':22B 'iv':61B 'key':59B 'packet':52B,54B 'receiv':47B 'root':74B 'rooxi':23B,31B 'router':21B,29B,37B 'rxr':24B,32B 'share':62B 'ship':38B 'special':49B 'start':44B 'telnet':26B,41B,77B 'udp':51B 'undocu':40B 'wi':35B 'wi-fi':34B 'wifi':28B 'wifi-rout':27B","search_c":"'-12':83C '-128':102C '/usr/bin/telnetd_startup':94C '20260813':126C 'access':124C 'ae':101C 'backdoor':92C 'c2169ea5':127C 'cbc':103C 'contain':88C 'credenti':120C 'daemon':93C 'default':119C 'enabl':115C 'entir':132C 'fi':86C 'firmwar':109C,125C 'firmware-wid':108C 'interfac':141C 'iv':114C 'key':112C 'listen':131C 'local':139C 'magic':104C 'packet':105C 'precomput':100C 'provid':121C 'receipt':97C 'remot':122C 'remov':128C 'root':123C 'rooxi':81C 'router':87C 'rxr':82C 'servic':117C 'static':111C 'telnet':91C,116C 'udp':130C 'undocu':90C 'updat':136C 'upon':96C 'use':106C 'user':134C 'web':140C 'wi':85C 'wi-fi':84C 'wide':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126722","severity":null,"published_at":"2026-11-11T17:17:18+00:00","modified_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}