Rooxis RXR-12 prior 20260813_c2169ea5 LuCI white_list RPC handler white_list_plt.lua os.execute mac os command injection

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Rooxis RXR-12. Affected is the function os.execute of the file /usr/lib/lua/luci/data/white_list_plt.lua of the component LuCI white_list RPC handler. The manipulation of the argument mac leads to os command injection. This vulnerability is listed as CVE-2026-126723. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Rooxis RXR-12. This issue affects the function os.execute of the file /usr/lib/lua/luci/data/white_list_plt.lua of the component LuCI white_list RPC handler. The manipulation of the argument mac with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.

It is possible to read the advisory at rooxis.com. The identification of this vulnerability is CVE-2026-126723 since 11/11/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/11/2026). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Upgrading to version 20260813_c2169ea5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Rooxis

Name

• RXR-12

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion