System Command Injection Affecting Cisco Small Business RV130, RV130W, RV110W Routers
A vulnerability affecting Cisco RV130, RV130W, and RV110W routers would allow an authenticated attacker to remotely execute arbitrary code with root privileges on affected systems.
Description
Technical context and vulnerability details
The Cisco RV130, RV130W, and RV110W are small business VPN routers. These products are affected by a vulnerability labeled CVE-2026-24697 resulting from a validation defect of the wan_hostname configuration parameter within the start_bonjour() function of the “rc” binary. Exploitation of this vulnerability would allow a remotely authenticated attacker to inject and execute arbitrary commands with root privileges on the device. It is classified high with a severity score of 7.2 according to CVSS V3.1
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Privilege escalation;
- Compromise of system integrity;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- Cisco RV130 and RV130W routers running firmware 1.0.3.55;
- The Cisco RV110W router running firmware 1.2.2.5 and 1.2.2.8;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- As this equipment has reached the end of its life, no corrective action is planned by the auditor: it is recommended to replace it with models still supported;
- Restrict access to the administration interface to administrators and trusted networks only;
- Disable remote management when it is not essential;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.