Authenticated Command Injection in Rooxis RXR-12 Wi-Fi Router

CVE-2026-126723

What is CVE-2026-126723?

The Rooxis RXR-12 Wi-Fi router suffers from an authenticated command injection vulnerability due to unsanitized user-supplied MAC addresses being improperly handled in the LuCI white_list RPC handler. This allows attackers with authenticated access to the router to execute arbitrary commands on the underlying operating system by crafting a malicious MAC address. To mitigate this risk, users are advised to update their router firmware to version 20260813_c2169ea5, which addresses the security flaw. Firmware updates can be performed conveniently through the local web interface of the router.

References