# CVE-2026-126724: Rooxis RXR-12 Wi-Fi router undocumented root backdoor account

Source: https://junglewise.ai/threats/cve-2026-126724-rooxis-rxr-12-wi-fi-router-contains-an-undocumented-uid-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126724 · Severity: info · Published 2026-11-11

The Rooxis RXR-12 Wi-Fi router contains a hidden administrator account with a factory-default password that is identical across all units. An attacker with network access to the router can log in as root via SSH or telnet using this account, gaining complete control over the device to intercept traffic, modify settings, or launch attacks on connected networks.

Technologies: [Rooxis RXR-12](https://junglewise.ai/threats/technologies/rxr-12). Vendors: [Rooxis](https://junglewise.ai/threats/vendors/rooxis).

## Quick answers

**Is CVE-2026-126724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126724 being exploited in the wild.

**How severe is CVE-2026-126724?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Rooxis RXR-12 firmware 20250715_247c4391 and earlier.

**Is there a fix for CVE-2026-126724?** Yes: fixed in Firmware 20260813_c2169ea5 (factory reset required for the fix to take effect). Until then: Perform a factory reset after updating to firmware 20260813_c2169ea5 to remove the undocumented account. Disable SSH root password login and disable telnet if possible through the web interface, and restrict remote management access to trusted networks only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126724 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-126724?** Check whether you run Rooxis RXR-12 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Firmware 20260813_c2169ea5 (factory reset required for the fix to take effect)

Perform a factory reset after updating to firmware 20260813_c2169ea5 to remove the undocumented account. Disable SSH root password login and disable telnet if possible through the web interface, and restrict remote management access to trusted networks only.

## Technical details

The vulnerability is a hardcoded backdoor account (UID 0) with an undocumented username and a firmware-wide default password that can be recovered from public wordlists in seconds. SSH root password authentication and telnet are enabled by default, allowing remote network-based authentication without device-specific secrets. The patched firmware (20260813_c2169ea5) removes the account after a factory reset, but the fix does not apply to in-place upgrades because the configuration overlay preserves the old password file.

## Affected products

- Rooxis RXR-12 firmware 20250715_247c4391 and earlier

## Timeline

- 2026-11-09: disclosed
- 2026-11-11: advisory

## References

- [https://lab.geodesy.phd/writeups/rooxis-router/](https://lab.geodesy.phd/writeups/rooxis-router/)
- [https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin](https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin)

## Related threats

- [Rooxis RXR-12 authenticated command injection in LuCI web UI](https://junglewise.ai/threats/cve-2026-126723-rooxis-rxr-12-wi-fi-router-contains-an-authenticated-command)
- [Rooxis RXR-12 telnet backdoor with static encryption key](https://junglewise.ai/threats/cve-2026-126722-rooxis-rxr-12-wi-fi-router-contains-an-undocumented-telnet)
- [Rooxis RXR-12 unauthenticated remote code execution in cloud manager](https://junglewise.ai/threats/cve-2026-126720-rooxis-rxr-12-wi-fi-router-contains-an-unauthenticated-remote)