{"affected":[{"product":"Rooxis RXR-12","source":"CNA: certcc","vendor":"Rooxis","versions":[{"lessThan":"20260813_c2169ea5","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-126722","cwes":["CWE-78"],"description":"Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813_c2169ea5 removes the UDP listener entirely, and users can update through their local web interface.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794417438793,"publishedAt":1794415302039,"references":[{"source":"CNA: certcc","tags":[],"url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"},{"source":"CNA: certcc","tags":[],"url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","tags":[],"url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","tags":[],"url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"remediation":[],"revision":"155ccc4545f9bc89aa16575d177c03f5fa7c9a08811065a54d9021ab343dd01b","sources":[{"modifiedAt":1794415302039,"name":"CNA: certcc","retrievedAt":1794416925105,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126722"},{"modifiedAt":1794417438793,"name":"NVD","retrievedAt":1794421062451,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126722"}],"ssvc":null,"status":"published","title":"CVE-2026-126722","updatedAt":1794421062451}