PT-2026-145283
CVE-2026-126723
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white list RPC handler (/usr/lib/lua/luci/data/white list plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813 c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.
Found an issue in the description? Have something to add? Feel free to write us 👾