EUVD-2026-42290
GHSA-pv42-mgvv-jhv9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) with simple injection (AC:L) but mandatory admin authentication (PR:H); root command execution yields total confidentiality, integrity, and availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The model_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.
AnalysisAI
Root-level OS command injection in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W (firmware 1.2.2.5/1.2.2.8) small-business routers lets an authenticated remote attacker run arbitrary commands via the unsanitized model_name parameter in the httpd binary's save_syslog_to_file() function. Because injected commands run as root, successful exploitation yields full device takeover. Publicly available exploit code exists (SSVC exploitation status: poc) but the flaw is not listed in CISA KEV.
Technical ContextAI
The vulnerability lives in the web management daemon (the 'httpd' binary) that ships in Cisco's RV-series SOHO/SMB router firmware. The syslog export routine save_syslog_to_file() incorporates the attacker-influenced model_name configuration value into a shell command without sanitization, matching CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Because embedded router web servers typically execute as root on these BusyBox/Linux-based appliances, shell metacharacters in model_name break out of the intended command context and execute with full system privileges. The affected surface is the device management HTTP(S) interface rather than a general-purpose library.
RemediationAI
No vendor-released patch identified at time of analysis, and the Cisco RV130/RV130W and RV110W are end-of-life small-business platforms for which fixes may not be forthcoming - plan for replacement with a supported router as the durable fix. As compensating controls, disable remote (WAN-side) HTTP/HTTPS management entirely and restrict the web management interface to trusted LAN hosts or a management VLAN only, which removes the network-facing exposure at the cost of requiring on-site or VPN-based administration. Enforce strong, unique administrator credentials and, where supported, ACLs limiting which source IPs can reach the management port, since exploitation requires authenticated admin access (PR:H); this reduces the chance that stolen or default credentials enable the attack. Monitor the device logs and management-interface access for anomalous syslog-configuration changes. Consult the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-24698) and any subsequent Cisco advisory for updated fixed-version information before relying solely on these mitigations.
More in Rv130 Firmware
View allA vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV1
Multiple vulnerabilities in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Ro
Multiple vulnerabilities in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Ro
OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator injec
Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administ
Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated remote a
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today