CVE-2026-24698
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W (firmware 1.2.2.5/1.2.2.8) routers. The model_name configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Risk Assessment
An attacker can gain full control over the device, alter network configuration, intercept traffic, or use the router as a pivot point to attack the internal network of the organization.
Recommendation
Immediately update the router firmware to a patched version, or if unavailable, restrict management interface access to trusted IP addresses and disable unnecessary services.
Other vulnerabilities in Cisco RV130/RV130W/RV110W
See all- CVE-2026-24700High
An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W routers (firmware 1.2.2.5/1.2.2.8). The machine_name configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary commands with root privileges.
- CVE-2026-24699High
An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W routers (firmware 1.2.2.5/1.2.2.8). The lan_ipv6_prefixlen configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.
- CVE-2026-24697High
An OS command injection vulnerability exists in the start_bonjour() function of the 'rc' binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5/1.2.2.8. The wan_hostname configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Original NVD description (English source)
An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The model_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.