{"id":"CVE-2026-126723","kind":"vulnerability","aliases":["CVE-2026-126723"],"related":[],"title":"Rooxis RXR-12 router: authenticated command injection gives root shell","description":"Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.","summary":"The Rooxis RXR-12 Wi-Fi router's LuCI white_list RPC handler concatenates an unvalidated MAC address parameter into os.execute(), so a logged-in user can run arbitrary commands as root. Firmware 20260813_c2169ea5 fixes the flaw, and the router can be updated through its local web interface.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","luci","openwrt","rooxis","router","rxr-12"],"not_affected_if":["firmware-updated","no-admin-access"],"how_to_check":"- Check the router's current firmware version in its local web interface (the version shown in the status or system page) and compare it with `20260813_c2169ea5`.\n- Confirm whether the device runs the vulnerable white_list RPC handler at `/usr/lib/lua/luci/data/white_list_plt.lua`; the sources do not say how to verify this from outside the device.","fix":"- Rooxis RXR-12: update to firmware `20260813_c2169ea5` or later.","status":"open","published_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:28:58+00:00","updated_at":"2026-11-11T17:28:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T17:28:58Z","model":"claude-haiku-5-5","output":{"fix":"- Rooxis RXR-12: update to firmware `20260813_c2169ea5` or later.","reach":"local","title":"Rooxis RXR-12 router: authenticated command injection gives root shell","impact":"high","summary":"The Rooxis RXR-12 Wi-Fi router's LuCI white_list RPC handler concatenates an unvalidated MAC address parameter into os.execute(), so a logged-in user can run arbitrary commands as root. Firmware 20260813_c2169ea5 fixes the flaw, and the router can be updated through its local web interface.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["rooxis","rxr-12","router","luci","openwrt"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the router.","analyst_note":"","how_to_check":"- Check the router's current firmware version in its local web interface (the version shown in the status or system page) and compare it with `20260813_c2169ea5`.\n- Confirm whether the device runs the vulnerable white_list RPC handler at `/usr/lib/lua/luci/data/white_list_plt.lua`; the sources do not say how to verify this from outside the device.","plain_action":"Update your Rooxis RXR-12 router to firmware 20260813_c2169ea5 through its local web interface.","product_name":"","needs_analyst":false,"not_affected_if":["firmware-updated","no-admin-access"],"who_is_affected":"Owners of Rooxis RXR-12 Wi-Fi routers running firmware older than 20260813_c2169ea5 are exposed. Exploitation requires an authenticated session on the router's web interface, so the risk is highest for anyone else with login access to the device or its admin panel. Other router models and firmware are not mentioned in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000808,"input_tokens":4618,"output_tokens":693,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-12':3A,23B,27B,77C '-126723':13A,16A '-2026':12A,15A '/usr/lib/lua/luci/data/white_list_plt.lua':95C '20260813':59B,119C 'address':42B,102C 'arbitrari':54B 'authent':5A,84C 'c2169ea5':60B,120C 'command':6A,55B,85C,111C 'concaten':38B,104C 'contain':82C 'cve':11A,14A 'execut':112C 'fi':30B,80C 'firmwar':58B,118C 'fix':61B,121C 'flaw':63B 'give':8A 'handler':37B,94C 'infrastructur':17B 'inject':7A,86C 'interfac':74B,134C 'list':35B,92C 'local':72B,132C 'log':49B 'logged-in':48B 'luci':18B,33B,90C 'mac':41B,101C,116C 'malform':115C 'openwrt':19B 'os.execute':45B,106C 'paramet':43B,117C 'root':9A,57B,110C 'rooxi':1A,20B,25B,75C 'router':4A,21B,31B,66B,81C,129C 'rpc':36B,93C 'run':53B 'rxr':2A,22B,26B,76C 'shell':10A 'suppli':100C 'unsanit':97C 'unvalid':40B 'updat':69B,127C 'user':51B,99C,125C 'user-suppli':98C 'valid':108C 'via':113C 'vulner':87C,123C 'web':73B,133C 'white':34B,91C 'wi':29B,79C 'wi-fi':28B,78C 'without':107C 'yield':109C","nicknames":[],"mitigations":[],"who_affected":"Owners of Rooxis RXR-12 Wi-Fi routers running firmware older than 20260813_c2169ea5 are exposed. Exploitation requires an authenticated session on the router's web interface, so the risk is highest for anyone else with login access to the device or its admin panel. Other router models and firmware are not mentioned in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Rooxis RXR-12 router to firmware 20260813_c2169ea5 through its local web interface.","pkeys":[],"ptokens":[],"labels":["high","infrastructure","luci","openwrt","rooxis","router","rxr12"],"campaign_type":null,"search_a":"'-12':3A '-126723':13A,16A '-2026':12A,15A 'authent':5A 'command':6A 'cve':11A,14A 'give':8A 'inject':7A 'root':9A 'rooxi':1A 'router':4A 'rxr':2A 'shell':10A","search_b":"'-12':23B,27B '20260813':59B 'address':42B 'arbitrari':54B 'c2169ea5':60B 'command':55B 'concaten':38B 'fi':30B 'firmwar':58B 'fix':61B 'flaw':63B 'handler':37B 'infrastructur':17B 'interfac':74B 'list':35B 'local':72B 'log':49B 'logged-in':48B 'luci':18B,33B 'mac':41B 'openwrt':19B 'os.execute':45B 'paramet':43B 'root':57B 'rooxi':20B,25B 'router':21B,31B,66B 'rpc':36B 'run':53B 'rxr':22B,26B 'unvalid':40B 'updat':69B 'user':51B 'web':73B 'white':34B 'wi':29B 'wi-fi':28B","search_c":"'-12':77C '/usr/lib/lua/luci/data/white_list_plt.lua':95C '20260813':119C 'address':102C 'authent':84C 'c2169ea5':120C 'command':85C,111C 'concaten':104C 'contain':82C 'execut':112C 'fi':80C 'firmwar':118C 'fix':121C 'handler':94C 'inject':86C 'interfac':134C 'list':92C 'local':132C 'luci':90C 'mac':101C,116C 'malform':115C 'os.execute':106C 'paramet':117C 'root':110C 'rooxi':75C 'router':81C,129C 'rpc':93C 'rxr':76C 'suppli':100C 'unsanit':97C 'updat':127C 'user':99C,125C 'user-suppli':98C 'valid':108C 'via':113C 'vulner':87C,123C 'web':133C 'white':91C 'wi':79C 'wi-fi':78C 'without':107C 'yield':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126723","severity":null,"published_at":"2026-11-11T17:17:18+00:00","modified_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}