Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Rooxis |
|
No data.
No data.
References
History
Sun, 15 Nov 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Rooxis
Rooxis rooxis Rxr-12 |
|
| Vendors & Products |
Rooxis
Rooxis rooxis Rxr-12 |
Sat, 14 Nov 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-732 |
Fri, 13 Nov 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 CWE-798 |
Thu, 12 Nov 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 CWE-798 |
Wed, 11 Nov 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface. | |
| Title | CVE-2026-126724 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: certcc
Published: 2026-11-11T16:41:18.243Z
Updated: 2026-11-11T16:41:18.243Z
Reserved: 2026-11-11T16:35:02.363Z
Link: CVE-2026-126724
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-11T17:17:19.053
Modified: 2026-11-12T19:22:01.433
Link: CVE-2026-126724
Redhat
No data.