High severity7.2NVD Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-24697
CVE-2026-24697
Description
An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The wan_hostname configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Affected products
7- Range: 1.0.3.55
- Range: 1.0.3.55
- Range: 1.2.2.5 / 1.2.2.8
- cpe:2.3:o:cisco:rv130_firmware:1.0.3.55:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv130w_firmware:1.0.3.55:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv110w_firmware:1.2.2.5:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:cisco:rv110w_firmware:1.2.2.5:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv110w_firmware:1.2.2.8:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
1- github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/2/wp-en.mdnvdThird Party Advisory
News mentions
0No linked articles in our index yet.