PT-2026-145281
CVE-2026-126720
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Rooxis RXR-12 Wi-Fi router versions prior to 20260813 c2169ea5
Description
An unauthenticated remote code execution issue exists in the
/usr/bin/cloud manage binary. The problem occurs when a server-controlled JSON diagnoseParameter field is passed unsanitized to the popen() function. This allows an attacker positioned on-path with access to the hard-coded cloud endpoint to execute arbitrary commands as root over cleartext HTTP.Recommendations
Update to firmware version 20260813 c2169ea5 through the local web interface.
Found an issue in the description? Have something to add? Feel free to write us 👾