What is the CVSS score of CVE-2026-24700?

CVE-2026-24700 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Cisco RV130 are affected by CVE-2026-24700?

Cisco RV130, RV130W, and RV110W small-business routers contain an authenticated command injection vulnerability that allows administrator-level users to achieve root-level code execution on the…

How to fix or mitigate CVE-2026-24700?

Within 24 hours, conduct an inventory of all Cisco RV130, RV130W, and RV110W devices deployed in your network and immediately restrict administrative console and web interface access to essential personnel with MFA and credential rotation. Within 7 days, implement network segmentation to isolate affected routers from critical systems, enable audit logging of all administrative actions, and audit recent configuration change logs for unauthorized modifications. Within 30 days, monitor Cisco security advisories weekly for patch availability; if no patch emerges within 60 days, initiate procurement for replacement routers running current-generation firmware with active vendor support, prioritizing devices with internet-facing or mission-critical roles.

Cisco RV130 CVE-2026-24700

EUVD-2026-42292 HIGH

OS Command Injection (CWE-78)

2026-07-08 cve@mitre.org

GHSA-fw2w-997p-hrf9

Command Injection Cisco Rv110W Firmware Rv130W Firmware Rv130 Firmware

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Injection requires admin config-write access so PR:H; remotely reachable web UI gives AV:N/AC:L, and root command execution yields full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:13 vuln.today

CVE Published

Jul 08, 2026 - 15:16 cve.org

HIGH 7.2

CVE Published

Jul 08, 2026 - 15:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The machine_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

AnalysisAI

OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator inject arbitrary shell commands through the unsanitized machine_name configuration parameter, gaining root-level code execution on the device. The flaw lives in the start_lltd() function of the 'rc' binary and requires valid high-privilege credentials (CVSS 7.2, PR:H). Publicly available exploit code exists via a third-party IoT vulnerability write-up, but there is no confirmation of active exploitation and the EPSS probability is low (0.96%).

Technical ContextAI

The affected devices are Cisco RV-series small-business VPN/wireless routers running Linux-based firmware. The vulnerability is a classic CWE-78 OS Command Injection: the machine_name value from device configuration is passed into a shell context inside the start_lltd() routine of the 'rc' (run-control/init) binary - the component that launches the LLTD (Link Layer Topology Discovery) service. Because the parameter is neither escaped nor validated before being incorporated into a command string executed by the underlying OS, shell metacharacters embedded in machine_name are interpreted as commands. Since 'rc' and its spawned services run as root, injected commands inherit root privileges. Affected firmware per CPE data: cisco:rv130_firmware:1.0.3.55, cisco:rv130w_firmware:1.0.3.55, and cisco:rv110w_firmware:1.2.2.5 and 1.2.2.8.

RemediationAI

No vendor-released patch version is identified in the available data, and these RV130/RV130W/RV110W models are end-of-life Cisco Small Business products for which fixed firmware may never be issued - the primary remediation is to replace the affected routers with a currently supported model. As compensating controls: restrict administrative access to the router management interface to a trusted management VLAN or a small set of source IPs (this blocks the remote path since exploitation requires an authenticated admin session), disable remote/WAN-side management entirely so the web UI is not reachable from untrusted networks, and change any default or weak administrator credentials to remove the easiest route to the required PR:H authentication. Avoid configuring the machine_name / device name field with untrusted input. The trade-off of locking down management access is reduced remote administrability, which is acceptable for these devices. Consult NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-24700) and VulDB (https://vuldb.com/vuln/376883) for updates on any vendor advisory or fixed firmware.