EUVD-2026-42291
GHSA-g3h5-3fxg-cpq7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin access to router web UI
-
DeliveryOpen IPv6 LAN configuration form
-
ExploitInject shell metacharacters via lan_ipv6_prefixlen
-
Executionsub_34984() in 'rc' passes value to shell
-
PersistExecute arbitrary commands as root
-
ImpactEstablish persistent device control
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid administrative (high-privilege) access to the router's configuration interface, as reflected by CVSS PR:H, and the ability to submit or modify the IPv6 LAN configuration so that a crafted value reaches the lan_ipv6_prefixlen parameter handled by sub_34984() in the 'rc' binary. It further requires one of the specific vulnerable firmware builds: RV130/RV130W 1.0.3.55 or RV110W 1.2.2.5 / 1.2.2.8. Limiting factors are the mandatory admin authentication (no unauthenticated path is described) and network reachability of the management interface - where administration is restricted to LAN or a management VLAN, remote reach is substantially reduced; SSVC 'Automatable: no' indicates it is not trivially mass-exploitable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable but authentication-gated flaw requiring high privileges (administrative access), with low complexity and total confidentiality/integrity/availability impact once reached - consistent with SSVC's 'Technical Impact: total.' SSVC marks Automatable: no, meaning it is not readily wormable/mass-exploitable, which aligns with the low EPSS of 0.96% (57th percentile) and the absence of a CISA KEV listing. The signals are internally consistent: real technical impact (root) but a meaningful barrier (valid admin credentials or a chained auth bypass) that keeps mass exploitation unlikely. The primary risk driver is post-authentication privilege conversion - turning admin web access into root shell access - which matters most where these routers are internet-exposed with weak, default, or reused admin credentials, or when combined with a separate authentication bypass on this hardware family. This is a targeted-risk issue rather than a spray-and-pray internet threat. |
| Exploit ScenarioDerived | An attacker who has obtained administrative access to the router web interface - via default/reused credentials, phishing, or a chained auth bypass - submits an IPv6 LAN configuration in which the prefix-length field carries shell metacharacters and an embedded command. When the 'rc' binary processes lan_ipv6_prefixlen in sub_34984(), the payload executes as root, giving the attacker a persistent foothold on the device. A public proof-of-concept and technical write-up for this exact parameter already exist, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator inject shell commands through the unsanitized lan_ipv6_prefixlen configuration parameter, which reaches the vulnerable sub_34984() routine in the 'rc' binary. Because injected commands run as root, an admin-level attacker gains full control of the device operating system. Publicly available exploit code exists (SSVC 'poc' plus a GitHub write-up), but there is no public evidence of active exploitation and EPSS is low at 0.96% (57th percentile).
RemediationAI
No vendor-released patch identified at time of analysis; the Cisco RV110W, RV130, and RV130W are end-of-life Small Business routers, so a firmware fix may not be forthcoming and migration to a supported router platform is the durable remediation. As compensating controls: ensure the device management/administration interface is never exposed to the WAN/internet and restrict it to a trusted management VLAN or specific admin IPs (trade-off: remote administration convenience is lost); enforce strong, unique administrator credentials and rotate any default or shared passwords to raise the PR:H bar this exploit depends on; and disable/avoid IPv6 LAN configuration workflows that touch the vulnerable lan_ipv6_prefixlen parameter where operationally acceptable (trade-off: loss of IPv6 LAN features). Monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-24699) and VulDB (https://vuldb.com/vuln/376882) for any subsequent Cisco advisory, and treat the referenced GitHub write-up (https://github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/4/wp-en.md) as attacker-usable exploit detail when prioritizing.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices are Cisco Small Business RV-series SOHO/SMB routers running Cisco's embedded Linux-based firmware, where the internal 'rc' control binary applies configuration values. The flaw is a classic CWE-78 OS command injection: the lan_ipv6_prefixlen parameter (an IPv6 prefix length used when configuring LAN IPv6 settings) is passed into a shell context inside sub_34984() without validation or escaping, so shell metacharacters embedded in that value are interpreted by the underlying system shell. CPE data scopes this precisely to cisco:rv130_firmware and cisco:rv130w_firmware at 1.0.3.55 and cisco:rv110w_firmware at 1.2.2.5 and 1.2.2.8. Because router control processes typically run as root on these embedded platforms, successful injection yields root-level command execution.
Know when Rv110W Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) but requires admin credentials to submit the config (PR:H); simple, reliable injection (AC:L) yields root, so C/I/A all High with unchanged scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The lan_ipv6_prefixlen configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Executive ViewAI
Cisco RV130, RV130W, and RV110W small-business routers contain a root-level command injection vulnerability allowing authenticated administrators to gain full operating system control. With no vendor patch available and publicly available exploit code circulating, organizations using these devices as network edge gateways face potential unauthorized infrastructure takeover.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict administrative console access to isolated management networks with VPN-only connectivity; (2) Enforce principle of least privilege-audit and remove unnecessary admin accounts; (3) Disable IPv6 on LAN interfaces if not operationally required; (4) Log and alert on all configuration changes to lan_ipv6_prefixlen parameter; (5) Implement downstream network access controls to limit lateral movement if the device is compromised; (6) Prioritize replacement of affected models in next hardware refresh cycle.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Rv110W Firmware
View allThe web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W
A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV1
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless
A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote
A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthe
A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthe
Exploit-DB