CVE-2026-24699: Cisco RV130/RV110W OS Command Injection Vulnerability

Technical summary

CVE-2026-24699 is an OS command injection vulnerability in the sub_34984() function within the "rc" binary used by Cisco RV130, RV130W, and RV110W routers. The vulnerability stems from insufficient input sanitization of the lan_ipv6_prefixlen configuration parameter. Because the parameter is passed to a system call without proper escaping or validation, an authenticated attacker can inject shell metacharacters to execute arbitrary OS commands. The vulnerability runs in the context of the root user, granting complete system compromise. The CWE-78 classification (Improper Neutralization of Special Elements used in an OS Command) directly maps to classic command injection patterns.

Business impact

For organizations operating Cisco RV small business routers as edge gateways or branch office connectivity points, this vulnerability creates a path to full device compromise by privileged insiders or attackers who have obtained administrative credentials. Since these routers often serve as the perimeter security boundary, successful exploitation could enable lateral movement into internal networks, data exfiltration, man-in-the-middle attacks, or denial of service. The HIGH severity rating reflects the convergence of root-level code execution with high confidentiality, integrity, and availability impact.

Affected systems

The vulnerability affects Cisco RV130 and RV130W routers running firmware version 1.0.3.55, and Cisco RV110W routers running firmware versions 1.2.2.5 or 1.2.2.8. Organizations should conduct an inventory of deployed models and firmware revisions to identify exposure. Cisco's product lifecycle and support status for these small business devices should be verified to determine patch availability timelines.

Exploitability

Exploitation requires authenticated administrative access to the router's management interface. The attack vector is network-based with no user interaction required once credentials are obtained. The low complexity (AC:L) indicates the attack does not depend on race conditions, specialized configurations, or environmental factors—a straightforward parameter modification suffices. However, the requirement for high-privilege authentication (PR:H) significantly limits the attack surface; threats are primarily internal misuse, compromised management credentials, or attackers who have already breached adjacent systems.

Remediation

Firmware updates from Cisco will contain input validation and sanitization fixes for the lan_ipv6_prefixlen parameter. Until patches are applied, restrict administrative access through network segmentation, strong authentication policies (including multi-factor authentication if supported), and regular audits of who holds administrative credentials. Consider disabling IPv6 configuration features if not in use and review router access logs for suspicious parameter modifications.

Patch guidance

Monitor Cisco security advisories and product update pages for firmware releases addressing this CVE. Verify the specific firmware version numbers in the vendor advisory before deployment. Test patches in a non-production environment first, as firmware updates to network edge devices carry operational risk. Schedule patching during maintenance windows to minimize network disruption. Document baseline configurations before and after updates to catch any unintended behavioral changes.

Detection guidance

Monitor router management interface logs for authentication events and configuration changes involving IPv6 settings, particularly the lan_ipv6_prefixlen parameter. Look for suspicious patterns such as encoded shell metacharacters (%, $, backticks, parentheses) in configuration parameter values. Network intrusion detection systems (IDS) may flag command injection attempts in HTTP/HTTPS traffic to the router's management interface. Consider deploying syslog forwarding from the router to a centralized security information and event management (SIEM) system to improve visibility.

Why prioritize this

Although the vulnerability requires administrative credentials and is not on the CISA KEV list, the HIGH CVSS score and potential for root-level command execution warrant prompt attention. Organizations using these routers as network perimeter devices should prioritize patching, as successful exploitation enables full network compromise. The risk is elevated if administrative credentials are shared, reused across systems, or managed through weak processes.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects: (1) network-based attack vector with no physical access required; (2) low attack complexity—straightforward parameter injection; (3) high-privilege requirement, which limits but does not eliminate risk; (4) complete compromise of confidentiality, integrity, and availability; and (5) scope unchanged (impact limited to the router itself, not the broader system). The score appropriately emphasizes the severity of root-level code execution while accounting for the authentication barrier.

Frequently asked questions