CVE-2026-24700
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W routers (firmware 1.2.2.5/1.2.2.8). The machine_name configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary commands with root privileges.
Risk Assessment
The risk for the organization includes full compromise of the vulnerable router, potentially leading to breach of confidentiality, integrity, and availability of the network, as well as further attacks on internal infrastructure.
Recommendation
Immediately update the router firmware to the latest available version and restrict management interface access to trusted IP addresses only.
Other vulnerabilities in Cisco RV130/RV130W/RV110W
See all- CVE-2026-24699High
An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W routers (firmware 1.2.2.5/1.2.2.8). The lan_ipv6_prefixlen configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.
- CVE-2026-24698High
An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W (firmware 1.2.2.5/1.2.2.8) routers. The model_name configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.
- CVE-2026-24697High
An OS command injection vulnerability exists in the start_bonjour() function of the 'rc' binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5/1.2.2.8. The wan_hostname configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Original NVD description (English source)
An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The machine_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.