Rooxis RXR-12 Cloud Management /usr/bin/cloud_manage popen diagnoseParameter os command injection

Summaryinfo

A vulnerability was found in Rooxis RXR-12 and classified as very critical. This affects the function popen of the file /usr/bin/cloud_manage of the component Cloud Management. Such manipulation of the argument diagnoseParameter leads to os command injection. This vulnerability is documented as CVE-2026-126720. The attack can be executed remotely. There is not any exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in Rooxis RXR-12 (the affected version is unknown) and classified as very critical. Affected by this issue is the function popen of the file /usr/bin/cloud_manage of the component Cloud Management. The manipulation of the argument diagnoseParameter with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface.

The advisory is available at rooxis.com. This vulnerability is handled as CVE-2026-126720 since 11/11/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/11/2026). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Applying the patch 20260813_c2169ea5 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Rooxis

Name

• RXR-12

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion