Cisco RV130 CVE-2026-24697

Exploitation requires authenticated administrative access to the router (CVSS PR:H) and the ability to set the wan_hostname configuration parameter through the device's management/configuration interface - this parameter is the exact injection point, flowing into the start_bonjour() function of the 'rc' binary. The device must be one of the specific affected models/firmware (RV130/RV130W 1.0.3.55, RV110W 1.2.2.5 or 1.2.2.8), and the Bonjour service startup path that consumes wan_hostname must be reached. Limiting factors: the mandatory admin authentication means this is not usable by an unauthenticated attacker, and remote exploitation depends on the management interface being network-reachable from the attacker (WAN-exposed management dramatically increases risk, LAN-only restriction sharply reduces it). No user interaction is required (UI:N).

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N - network-reachable, low complexity, but requiring high privileges (administrative authentication), no user interaction, and full C/I/A impact. The high-privilege requirement is the main mitigating factor: an attacker must already hold admin credentials on the router, so this is primarily a privilege-escalation-to-root / persistence primitive rather than a pre-auth mass-exploitation bug. That said, admin credentials on SOHO routers are frequently weak, default, or reused, and many such devices expose management to the WAN, which raises real-world exposure. No EPSS score and no SSVC decision were supplied, so exploitation probability cannot be quantified from the input. The vulnerability is not listed in CISA KEV (no confirmed active exploitation), but a public write-up exists, indicating exploitation technique is documented. Net: a genuine root-code-execution risk on affected devices, gated by the need for admin access; priority is elevated for internet-exposed or default-credential deployments and lower where management access is tightly restricted.

An attacker who has obtained administrative access to an internet-exposed RV130/RV110W management interface (via default, weak, or reused credentials) sets the WAN hostname to a value containing shell metacharacters, e.g. a benign name followed by an injected command. When start_bonjour() builds and executes its command string, the injected payload runs as root, letting the attacker open a reverse shell, install persistence, or pivot into the internal network. A public write-up documenting the flaw makes reproduction straightforward for anyone with the required admin access.