CVE-2026-126723
2026-11-11
17h17 +00:00
17h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.
