---
id: "CVE-2026-126722"
page: "https://infrastack.ai/live/CVE-2026-126722"
kind: "vulnerability"
aliases: ["CVE-2026-126722"]
title: "Rooxis RXR-12 router: hidden magic packet enables telnet with root access"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["home-router", "infrastructure", "rooxis", "rxr-12", "telnet", "wifi-router"]
not_affected_if: ["firmware-updated", "other-router-model"]
published_at: "2026-11-11T17:17:18+00:00"
first_seen_at: "2026-11-11T17:28:22+00:00"
updated_at: "2026-11-11T17:28:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126722", "first_seen_at": "2026-11-11T17:28:22+00:00"}]
exploit_sources: []
---

# Rooxis RXR-12 router: hidden magic packet enables telnet with root access

Link for people: https://infrastack.ai/live/CVE-2026-126722 (this .md is for agents)

The Rooxis RXR-12 Wi-Fi router ships an undocumented telnet daemon that starts when it receives a specially encrypted UDP packet. The packet is encrypted with a key and IV shared across all firmware, so an attacker can build it and gain root access over telnet with default credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the router's firmware version in its local web interface and compare it with `20260813_c2169ea5`
- Look for the file `/usr/bin/telnetd_startup` on the device if you have shell access
- Check whether telnet (port 23) answers on the router from the local network

## Fix

- Update the RXR-12 to firmware `20260813_c2169ea5` or later, which removes the UDP listener; update through the router's local web interface

## Timeline

- 2026-11-11T17:28:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126722

## From the sources

Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813_c2169ea5 removes the UDP listener entirely, and users can update through their local web interface.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_