CVE-2026-126723 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The Rooxis RXR-12 Wi-Fi router's LuCI white_list RPC handler concatenates an unvalidated MAC address parameter into os.execute(), so a logged-in user can run arbitrary commands as root. Firmware 20260813_c2169ea5 fixes the flaw, and the router can be updated through its local web interface.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Owners of Rooxis RXR-12 Wi-Fi routers running firmware older than 20260813_c2169ea5 are exposed. Exploitation requires an authenticated session on the router's web interface, so the risk is highest for anyone else with login access to the device or its admin panel. Other router models and firmware are not mentioned in the sources.
Not affected if firmware-updated, no-admin-access
Who cares luci, openwrt, rooxis, router, rxr-12
20260813_c2169ea5./usr/lib/lua/luci/data/white_list_plt.lua; the sources do not say how to verify this from outside the device.20260813_c2169ea5 or later.Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.