Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Rooxis |
|
No data.
No data.
References
History
Sun, 15 Nov 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Rooxis
Rooxis rooxis Rxr-12 |
|
| Vendors & Products |
Rooxis
Rooxis rooxis Rxr-12 |
Sat, 14 Nov 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-20 |
Fri, 13 Nov 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 |
Thu, 12 Nov 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 |
Wed, 11 Nov 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface. | |
| Title | CVE-2026-126723 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: certcc
Published: 2026-11-11T16:41:28.727Z
Updated: 2026-11-11T16:41:28.727Z
Reserved: 2026-11-11T16:34:55.134Z
Link: CVE-2026-126723
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-11T17:17:18.907
Modified: 2026-11-12T19:22:01.433
Link: CVE-2026-126723
Redhat
No data.