CVE-2026-126720

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloudmanage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen, enabling arbitrary command execution as root over cleartext HTTP when an attacker is positione...