Undocumented Backdoor in Rooxis RXR-12 Wi-Fi Router Exposes Remote Access Risks

CVE-2026-126722

What is CVE-2026-126722?

The Rooxis RXR-12 Wi-Fi router has a security flaw that permits a remote backdoor access via an undocumented telnet service. Triggered by a specially crafted AES-128-CBC magic packet, this vulnerability exposes the device to unauthorized remote control using default login credentials. Users are urged to upgrade to firmware version 20260813_c2169ea5, which eliminates the risk by removing the UDP listener. Timely updates through the local web interface can help mitigate security risks associated with this vulnerability.

References