EUVD-2026-42291
GHSA-g3h5-3fxg-cpq7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) but requires admin credentials to submit the config (PR:H); simple, reliable injection (AC:L) yields root, so C/I/A all High with unchanged scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The lan_ipv6_prefixlen configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.
AnalysisAI
Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator inject shell commands through the unsanitized lan_ipv6_prefixlen configuration parameter, which reaches the vulnerable sub_34984() routine in the 'rc' binary. Because injected commands run as root, an admin-level attacker gains full control of the device operating system. Publicly available exploit code exists (SSVC 'poc' plus a GitHub write-up), but there is no public evidence of active exploitation and EPSS is low at 0.96% (57th percentile).
Technical ContextAI
The affected devices are Cisco Small Business RV-series SOHO/SMB routers running Cisco's embedded Linux-based firmware, where the internal 'rc' control binary applies configuration values. The flaw is a classic CWE-78 OS command injection: the lan_ipv6_prefixlen parameter (an IPv6 prefix length used when configuring LAN IPv6 settings) is passed into a shell context inside sub_34984() without validation or escaping, so shell metacharacters embedded in that value are interpreted by the underlying system shell. CPE data scopes this precisely to cisco:rv130_firmware and cisco:rv130w_firmware at 1.0.3.55 and cisco:rv110w_firmware at 1.2.2.5 and 1.2.2.8. Because router control processes typically run as root on these embedded platforms, successful injection yields root-level command execution.
RemediationAI
No vendor-released patch identified at time of analysis; the Cisco RV110W, RV130, and RV130W are end-of-life Small Business routers, so a firmware fix may not be forthcoming and migration to a supported router platform is the durable remediation. As compensating controls: ensure the device management/administration interface is never exposed to the WAN/internet and restrict it to a trusted management VLAN or specific admin IPs (trade-off: remote administration convenience is lost); enforce strong, unique administrator credentials and rotate any default or shared passwords to raise the PR:H bar this exploit depends on; and disable/avoid IPv6 LAN configuration workflows that touch the vulnerable lan_ipv6_prefixlen parameter where operationally acceptable (trade-off: loss of IPv6 LAN features). Monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-24699) and VulDB (https://vuldb.com/vuln/376882) for any subsequent Cisco advisory, and treat the referenced GitHub write-up (https://github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/4/wp-en.md) as attacker-usable exploit detail when prioritizing.
More in Rv130 Firmware
View allA vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV1
Multiple vulnerabilities in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Ro
Multiple vulnerabilities in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Ro
OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator injec
Root-level OS command injection in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W (firmware 1.2.2.5/1.2.2.8) small-bu
Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated remote a
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today