Is CVE-2026-126720 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126720 being exploited in the wild.

How severe is CVE-2026-126720?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Rooxis RXR-12 firmware 20250715_247c4391 and earlier.

How is CVE-2026-126720 attacked?

It is attacked over the network or from the adjacent network, in a network appliance.

Am I affected by CVE-2026-126720?

Check whether you run Rooxis RXR-12 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126720: Rooxis RXR-12 unauthenticated remote code execution in cloud manager

CVE-2026-126720 · Severity: info · Published 2026-11-11

The Rooxis RXR-12 Wi-Fi router's cloud management daemon accepts commands over unencrypted HTTP without verifying the server's identity or command authenticity. An attacker positioned on the network path can intercept these requests and inject arbitrary commands that execute as root on the router, giving complete control over the device and any networks it protects.

Technologies: Rooxis RXR-12. Vendors: Rooxis.

Quick answers

Is CVE-2026-126720 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126720 being exploited in the wild.
How severe is CVE-2026-126720?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Rooxis RXR-12 firmware 20250715_247c4391 and earlier.
Is there a fix for CVE-2026-126720?: Yes: fixed in firmware 20260813_c2169ea5. Until then: Isolate the router on a trusted network segment and restrict outbound HTTP traffic to the cloud endpoint. Perform a factory reset immediately after upgrading to firmware 20260813_c2169ea5 to ensure removal of undocumented default credentials and full application of security patches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126720 attacked?: It is attacked over the network or from the adjacent network, in a network appliance.
Am I affected by CVE-2026-126720?: Check whether you run Rooxis RXR-12 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: firmware 20260813_c2169ea5

Isolate the router on a trusted network segment and restrict outbound HTTP traffic to the cloud endpoint. Perform a factory reset immediately after upgrading to firmware 20260813_c2169ea5 to ensure removal of undocumented default credentials and full application of security patches.

Technical details

The cloud_manage daemon polls a vendor endpoint over plaintext HTTP and passes unsanitized JSON fields from the server response to popen(), enabling OS command injection. An on-path attacker can answer the heartbeat request with a crafted diagnoseParameter value containing shell metacharacters to execute commands as root. No authentication (TLS, certificate pinning, command signing) protects the channel. The vulnerability requires network adjacency and the ability to intercept or redirect HTTP traffic.

Affected products

Rooxis RXR-12 firmware 20250715_247c4391 and earlier

Timeline

2026-11-11: disclosed
2026-11-09: advisory
2026-08-13: patched: Remediation build 20260813_c2169ea5 provided to vendor

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.