Cisco RV130 CVE-2026-24698

Exploitation requires an authenticated session with high/administrative privileges on the router's web management interface (CVSS PR:H) and network reachability to that interface; it is not remotely exploitable without valid admin credentials. The specific trigger is supplying a crafted value in the model_name configuration parameter and invoking the save_syslog_to_file() syslog-export function in the httpd binary. Limiting factors: admin authentication is mandatory, the attack targets the management HTTP(S) service (so restricting or disabling WAN-side management blocks external attackers), and it applies only to the named firmware builds on RV130/RV130W and RV110W hardware. No user interaction by a victim is required (UI:N).

Signals are moderately consistent but point to a targeted rather than mass-exploitation risk. CVSS 3.1 is 7.2 (AV:N/AC:L/PR:H/UI:N) - network-reachable and low-complexity, but PR:H means the attacker must already hold high (administrative) privileges on the management interface, which substantially narrows the realistic attacker population. SSVC reinforces this: Technical Impact is 'total' (root code execution) yet Automatable is 'no', consistent with the need for authenticated, per-device interaction rather than wormable exploitation. Exploitation status is 'poc' (proof-of-concept public), so exploit code exists but there is no confirmation of active in-the-wild use (not in CISA KEV). No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. Net: high technical impact gated behind admin authentication - a credible post-authentication privilege/persistence escalation on exposed or credential-compromised devices, but not a drive-by unauthenticated threat.

An attacker who has obtained administrator credentials (via phishing, credential reuse, default passwords, or a chained auth bypass) logs into the router's web management interface, which is reachable over the network. They set the model_name configuration parameter to a value containing shell metacharacters and trigger the syslog-to-file save operation, causing the httpd process to execute their injected commands as root. A public proof-of-concept write-up documenting the flaw exists, lowering the effort to reproduce it.