{"id":"CVE-2026-126724","kind":"vulnerability","aliases":["CVE-2026-126724"],"related":[],"title":"Rooxis RXR-12 Wi-Fi router: hidden root account with fixed default password","description":"Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface.","summary":"The Rooxis RXR-12 Wi-Fi router ships with an undocumented account named dg that has root privileges and the firmware-wide default password ivanlee. An attacker who knows this can log in as root over SSH or the local console and take full control of the router.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-router","infrastructure","rooxis","rxr-12","wifi"],"not_affected_if":["fixed-firmware","ssh-disabled"],"how_to_check":"- Check the firmware version on the router's web interface against `20260813_c2169ea5`\n- Try logging in over SSH with user `dg` and password `ivanlee` on a device you own; unknown whether the sources give a further check","fix":"- Update the RXR-12 firmware to `20260813_c2169ea5`, which removes the account and disables root password authentication over SSH\n- The update can be applied through the local web interface","status":"open","published_at":"2026-11-11T17:17:19+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:28:55+00:00","updated_at":"2026-11-11T17:28:55+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-11T17:28:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update the RXR-12 firmware to `20260813_c2169ea5`, which removes the account and disables root password authentication over SSH\n- The update can be applied through the local web interface","reach":"network","title":"Rooxis RXR-12 Wi-Fi router: hidden root account with fixed default password","impact":"high","summary":"The Rooxis RXR-12 Wi-Fi router ships with an undocumented account named dg that has root privileges and the firmware-wide default password ivanlee. An attacker who knows this can log in as root over SSH or the local console and take full control of the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["rooxis","rxr-12","home-router","wifi"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gains root shell on the router and controls its traffic","analyst_note":"","how_to_check":"- Check the firmware version on the router's web interface against `20260813_c2169ea5`\n- Try logging in over SSH with user `dg` and password `ivanlee` on a device you own; unknown whether the sources give a further check","plain_action":"Update your Rooxis RXR-12 router firmware to 20260813_c2169ea5 through its local web interface.","product_name":"","needs_analyst":false,"not_affected_if":["fixed-firmware","ssh-disabled"],"who_is_affected":"Anyone running the Rooxis RXR-12 router with firmware older than 20260813_c2169ea5 is exposed, because the hidden account and its default password are identical on every device. Exposure over the network depends on whether SSH or the local console is reachable; the sources do not say whether the router is reachable from the internet by default. Devices already on the fixed firmware are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000789,"input_tokens":4611,"output_tokens":655,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0':90C '-12':3A,27B,32B,81C '-126724':17A,20A '-2026':16A,19A '/bin/ash':105C '20260813':121C 'account':10A,41B,92C,125C 'allow':106C 'attack':57B 'authent':107C,135C 'backdoor':91C 'c2169ea5':122C 'consol':71B,114C 'contain':86C 'control':75B 'cve':15A,18A 'default':13A,53B,99C 'devic':117C 'device-specif':116C 'dg':43B,93C 'disabl':132C 'fi':6A,35B,84C 'filesystem':130C 'firmwar':51B,97C,120C 'firmware-wid':50B,96C 'fix':12A 'full':74B 'hidden':8A 'home':22B 'home-rout':21B 'infrastructur':24B 'interact':103C 'interfac':149C 'ivanle':55B,101C 'know':59B 'local':70B,113C,147C 'log':62B 'name':42B 'password':14A,54B,100C,134C 'privileg':47B 'remov':123C 'root':9A,46B,65B,109C,129C,133C 'rooxi':1A,25B,30B,79C 'router':7A,23B,36B,78B,85C,142C 'rxr':2A,26B,31B,80C 'secret':119C 'shell':104C 'ship':37B,128C 'specif':118C 'ssh':67B,111C,137C 'take':73B 'uid':89C 'undocu':40B,88C 'updat':140C 'user':138C 'via':110C 'web':148C 'wi':5A,34B,83C 'wi-fi':4A,33B,82C 'wide':52B,98C 'wifi':28B 'without':115C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the Rooxis RXR-12 router with firmware older than 20260813_c2169ea5 is exposed, because the hidden account and its default password are identical on every device. Exposure over the network depends on whether SSH or the local console is reachable; the sources do not say whether the router is reachable from the internet by default. Devices already on the fixed firmware are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Rooxis RXR-12 router firmware to 20260813_c2169ea5 through its local web interface.","pkeys":[],"ptokens":[],"labels":["critical","homerouter","infrastructure","rooxis","rxr12","wifi"],"campaign_type":null,"search_a":"'-12':3A '-126724':17A,20A '-2026':16A,19A 'account':10A 'cve':15A,18A 'default':13A 'fi':6A 'fix':12A 'hidden':8A 'password':14A 'root':9A 'rooxi':1A 'router':7A 'rxr':2A 'wi':5A 'wi-fi':4A","search_b":"'-12':27B,32B 'account':41B 'attack':57B 'consol':71B 'control':75B 'default':53B 'dg':43B 'fi':35B 'firmwar':51B 'firmware-wid':50B 'full':74B 'home':22B 'home-rout':21B 'infrastructur':24B 'ivanle':55B 'know':59B 'local':70B 'log':62B 'name':42B 'password':54B 'privileg':47B 'root':46B,65B 'rooxi':25B,30B 'router':23B,36B,78B 'rxr':26B,31B 'ship':37B 'ssh':67B 'take':73B 'undocu':40B 'wi':34B 'wi-fi':33B 'wide':52B 'wifi':28B","search_c":"'-0':90C '-12':81C '/bin/ash':105C '20260813':121C 'account':92C,125C 'allow':106C 'authent':107C,135C 'backdoor':91C 'c2169ea5':122C 'consol':114C 'contain':86C 'default':99C 'devic':117C 'device-specif':116C 'dg':93C 'disabl':132C 'fi':84C 'filesystem':130C 'firmwar':97C,120C 'firmware-wid':96C 'interact':103C 'interfac':149C 'ivanle':101C 'local':113C,147C 'password':100C,134C 'remov':123C 'root':109C,129C,133C 'rooxi':79C 'router':85C,142C 'rxr':80C 'secret':119C 'shell':104C 'ship':128C 'specif':118C 'ssh':111C,137C 'uid':89C 'undocu':88C 'updat':140C 'user':138C 'via':110C 'web':148C 'wi':83C 'wi-fi':82C 'wide':98C 'without':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126724","severity":null,"published_at":"2026-11-11T17:17:19+00:00","modified_at":"2026-11-11T17:17:19+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}