High severity7.2NVD Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-24700
CVE-2026-24700
Description
An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The machine_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Affected products
7cpe:2.3:o:cisco:rv110w_firmware:1.2.2.5:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:cisco:rv110w_firmware:1.2.2.5:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv110w_firmware:1.2.2.8:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv130_firmware:1.0.3.55:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv130w_firmware:1.0.3.55:*:*:*:*:*:*:*
- Range: 1.0.3.55
- Range: 1.2.2.5 / 1.2.2.8
- Range: 1.0.3.55
Patches
Vulnerability mechanics
References
1- github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/1/wp-en.mdnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.