CVE-2026-126723

Sin historial EPSS suficiente todavía.

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.

• lab.geodesy.phdhttps://lab.geodesy.phd/writeups/rooxis-router/
• rooxis.comhttps://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin

Sin CVEs relacionados por CWE o producto.