Undocumented Backdoor in Rooxis RXR-12 Wi-Fi Router

CVE-2026-126724

What is CVE-2026-126724?

The Rooxis RXR-12 Wi-Fi router contains a serious security issue with an undocumented UID-0 backdoor account named 'dg', which is protected by a firmware-wide default password 'ivanlee'. This vulnerability enables an attacker to gain root access through SSH or local console without needing device-specific secrets. The firmware version 20260813_c2169ea5 addresses this issue by removing the backdoor account from the root filesystem and disabling root password authentication via SSH, ensuring that users can secure their devices by updating through the local web interface.

References