CVE-2026-126723

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white list RPC handler (/usr/lib/lua/luci/data/white list plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813 c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.