CVE-2026-126724 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The Rooxis RXR-12 Wi-Fi router ships with an undocumented account named dg that has root privileges and the firmware-wide default password ivanlee. An attacker who knows this can log in as root over SSH or the local console and take full control of the router.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running the Rooxis RXR-12 router with firmware older than 20260813_c2169ea5 is exposed, because the hidden account and its default password are identical on every device. Exposure over the network depends on whether SSH or the local console is reachable; the sources do not say whether the router is reachable from the internet by default. Devices already on the fixed firmware are not affected.
Not affected if fixed-firmware, ssh-disabled
Who cares home-router, rooxis, rxr-12, wifi
20260813_c2169ea5dg and password ivanlee on a device you own; unknown whether the sources give a further check20260813_c2169ea5, which removes the account and disables root password authentication over SSHRooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.