CVE-2026-24698

Published: Jul 8, 2026Modified: Jul 10, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The model_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

Affected (4)

Products: Cisco: Rv130 Firmware, Rv130w Firmware, Rv110w Firmware

3 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Rv130 Firmware	Version 1.0.3.55

Running on/with	Platform Versions
Cisco Rv130	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Rv130w Firmware	Version 1.0.3.55

Running on/with	Platform Versions
Cisco Rv130w	All versions

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Rv110w Firmware	Version 1.2.2.5
Cisco Rv110w Firmware	Version 1.2.2.8

Running on/with	Platform Versions
Cisco Rv110w	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/3/wp-en.md

Source: cve@mitre.org

Third Party Advisory

https://github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/3/wp-en.md

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party Advisory

Timeline

No history available yet.