Is CVE-2026-126722 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126722 being exploited in the wild.

How severe is CVE-2026-126722?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Rooxis RXR-12 20250715_247c4391 (shipping); fixed in 20260813_c2169ea5.

How is CVE-2026-126722 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-126722?

Check whether you run Rooxis RXR-12 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126722: Rooxis RXR-12 telnet backdoor with static encryption key

CVE-2026-126722 · Severity: info · Published 2026-11-11

The Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor that can be activated remotely by sending a specially crafted encrypted packet. An attacker with network access can enable telnet and gain root access to the router, compromising the security of all devices on the network. The vendor has removed the backdoor listener in a firmware update, but users must actively update to be protected.

Technologies: Rooxis RXR-12. Vendors: Rooxis.

Quick answers

Is CVE-2026-126722 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126722 being exploited in the wild.
How severe is CVE-2026-126722?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Rooxis RXR-12 20250715_247c4391 (shipping); fixed in 20260813_c2169ea5.
Is there a fix for CVE-2026-126722?: Yes: fixed in 20260813_c2169ea5. Until then: Users should disable telnet access on the router and restrict remote management features through the web interface until the firmware can be updated. Restricting network access to the router's management interface provides temporary protection against remote exploitation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126722 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126722?: Check whether you run Rooxis RXR-12 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 20260813_c2169ea5

Users should disable telnet access on the router and restrict remote management features through the web interface until the firmware can be updated. Restricting network access to the router's management interface provides temporary protection against remote exploitation.

Technical details

A UDP listener in the firmware-wide telnetd_startup daemon accepts AES-128-CBC encrypted magic packets using static keys hardcoded in the firmware. Upon receipt of a valid packet, the listener enables telnet service with default credentials, providing unauthenticated root access. This is a variant of the CVE-2022-25214 Phicomm backdoor. The vulnerability requires network access but no authentication, and the static encryption key is recoverable from the firmware binary.

Affected products

Rooxis RXR-12 20250715_247c4391 (shipping); fixed in 20260813_c2169ea5

Timeline

2026-11-09: disclosed: CERT/CC advisory published
2026-09-10: patched: Vendor supplied remediation build 20260813_c2169ea5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.