CVE-2026-126723

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI whitelist RPC handler /usr/lib/lua/luci/data/whitelistplt.lua, where unsanitized user-supplied MAC addresses are concatenated into os.execute without validation, yielding root command execution via a...