Threats tagged 'ghsa-qg3p-xvgg-3fqr'

The Rooxis RXR-12 Wi-Fi router has an authenticated command injection vulnerability in its LuCI white_list RPC handler. This flaw arises because user-supplied MAC addresses are not properly sanitized before being passed to os.execute(), allowing an attacker with authentication to execute arbitrary root commands. The vulnerability is fixed in firmware version 20260813_c2169ea5, which users can install via the router's local web interface.