CVE-2026-24700: Cisco RV130/RV110W OS Command Injection—Admin Authentication Required

Technical summary

CVE-2026-24700 is an OS command injection vulnerability (CWE-78) in the start_lltd() function within the rc binary of Cisco RV130, RV130W, and RV110W routers. The machine_name configuration parameter undergoes insufficient input validation, permitting authenticated remote attackers to inject shell metacharacters and execute arbitrary commands with root privileges. The vulnerability affects RV130/RV130W running firmware 1.0.3.55 and RV110W running firmware 1.2.2.5 or 1.2.2.8.

Business impact

Compromise of these routers exposes internal networks to direct control by a malicious insider or an attacker who has obtained valid administrative credentials. Since these devices sit at the network perimeter, successful exploitation enables lateral movement into the enterprise network, potential data exfiltration, network reconnaissance, and deployment of persistent backdoors. For organizations relying on these models for branch office or remote site connectivity, this represents a critical trust boundary violation.

Affected systems

Cisco RV130 routers with firmware version 1.0.3.55, Cisco RV130W with firmware 1.0.3.55, and Cisco RV110W with firmware versions 1.2.2.5 or 1.2.2.8 are confirmed vulnerable. These are small business-grade routers commonly deployed in SMB and branch office environments. Administrators should verify their running firmware versions urgently against these specific builds.

Exploitability

Exploitation requires valid administrative credentials—the attacker must already be authenticated to the router management interface. This significantly reduces the immediate risk from untargeted external attacks, but substantially elevates risk in scenarios involving compromised admin accounts, insider threats, or lateral movement from a compromised internal network segment. No network-based unauthenticated attack path exists. The attack surface is primarily the web-based or SSH administrative interface.

Remediation

Organizations running affected firmware versions must apply vendor-supplied patches as soon as they become available. Interim mitigations include restricting administrative access to trusted networks only, implementing network segmentation to limit router management traffic, disabling remote administration features if not required, and enforcing strong, unique credentials for all administrative accounts. Monitor authentication logs for suspicious login attempts or unusual configuration changes.

Patch guidance

Contact Cisco support or consult the vendor security advisory for patched firmware versions applicable to your specific router model and current firmware branch. Verify the patch version against the official Cisco security advisory before deployment. Test patches in a non-production environment first, as router firmware updates can temporarily disrupt network connectivity. Coordinate patch deployment during approved maintenance windows.

Detection guidance

Monitor router access logs for failed authentication attempts targeting the admin interface. Watch for configuration changes involving the machine_name parameter, particularly those containing shell metacharacters (backticks, pipes, semicolons, $() constructs). Enable verbose logging on administrative actions if supported. Network-based detection is limited without privileged access to the management interface; focus detection efforts on authentication anomalies and post-exploitation behavioral indicators such as unexpected outbound connections from the router or unusual process activity if syslog forwarding is enabled.

Why prioritize this

While the CVSS score of 7.2 reflects a high-severity vulnerability, the requirement for prior authentication moderates the immediate blast radius. However, prioritization should remain high because: (1) these routers are security perimeters; (2) root-level command execution enables complete device compromise; (3) affected organizations typically operate multiple units; and (4) insider threat or credential compromise scenarios make this practically exploitable in real environments. Smaller organizations managing these devices may lack robust logging, making detection difficult post-breach.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects: Network-accessible attack vector (AV:N) via the management interface, low attack complexity (AC:L) once authenticated, high privilege requirement (PR:H) limiting unauthenticated exploitation, no user interaction needed (UI:N), unchanged scope (S:U), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The authentication prerequisite prevents a Critical rating but does not diminish the severity of what an authenticated attacker can accomplish.

Frequently asked questions