What is the CVSS score of CVE-2026-24697?

CVE-2026-24697 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Cisco RV130 are affected by CVE-2026-24697?

Cisco RV series small-business routers (RV130, RV130W, RV110W) contain a high-severity OS command injection vulnerability that allows authenticated administrators to inject arbitrary commands with…

How to fix or mitigate CVE-2026-24697?

Within 24 hours: Inventory all RV130, RV130W, and RV110W devices and audit administrative access. Within 7 days: Restrict remote management access to authorized networks only, disable unnecessary remote admin features, and implement MFA on remaining admin accounts. Within 30 days: Develop device replacement plan and establish continuous monitoring for Cisco security advisories.

Cisco RV130 CVE-2026-24697

EUVD-2026-42289 HIGH

OS Command Injection (CWE-78)

2026-07-08 cve@mitre.org

GHSA-5wp9-987m-q7mf

Command Injection Cisco Rv130 Firmware Rv130W Firmware Rv110W Firmware

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management with low complexity but requiring admin authentication (PR:H) to set wan_hostname; root command execution yields full C/I/A impact with scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 17:37 vuln.today

CVSS changed

Jul 08, 2026 - 17:22 NVD

7.2 (HIGH)

CVE Published

Jul 08, 2026 - 15:16 cve.org

HIGH 7.2

CVE Published

Jul 08, 2026 - 15:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The wan_hostname configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

AnalysisAI

Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated remote administrator inject arbitrary shell commands through the wan_hostname parameter, which is passed unsanitized into the start_bonjour() routine of the 'rc' binary. Because the 'rc' process runs as root, successful exploitation yields full command execution and complete device takeover. Publicly available exploit details exist in an IoT vulnerability write-up; there is no evidence of active exploitation (not in CISA KEV) and no EPSS score was provided.

Technical ContextAI

The affected devices are Cisco small-business WAN routers (RV130/RV130W VPN routers and the RV110W wireless-N VPN firewall). The flaw is a classic CWE-78 OS Command Injection: the wan_hostname configuration value, set through the web-management/configuration interface, is concatenated into a shell command inside the start_bonjour() function of the internal 'rc' (run-control) binary that manages service startup - in this case the Bonjour/mDNS service. Because input is neither escaped nor validated against shell metacharacters, an attacker can break out of the intended command context and append their own commands, which execute with the root privileges of the 'rc' process. These routers use a legacy embedded Linux/BusyBox-style firmware where such run-control binaries commonly invoke system() with configuration-derived strings.

RemediationAI

No vendor-released patch was identified at time of analysis, and notably the Cisco RV130, RV130W, and RV110W product lines reached end-of-life and end-of-security-support, so a firmware fix is unlikely to be issued - treat replacement of these devices with a supported model as the primary remediation. As compensating controls: disable remote/WAN-side web management so the configuration interface (and the wan_hostname parameter) is reachable only from the trusted LAN, which prevents remote attackers from setting the malicious value at the cost of losing remote administration; enforce strong, unique administrator credentials and change any defaults, since the attack requires authenticated admin access (PR:H); restrict management access to specific trusted IPs/VLANs via ACLs; and if the Bonjour/mDNS discovery feature can be disabled in the device configuration, doing so removes the start_bonjour() code path that consumes the tainted value, at the cost of losing local service discovery. Verify current firmware and available guidance against the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-24697) and the technical write-up (https://github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/2/wp-en.md).