OS Command Injection in Cisco RV130/RV130W and RV110W Routers

Executive Summary

CVE-2026-24699 is an OS command injection vulnerability found in the sub_34984() function of the "rc" binary in Cisco RV130 and RV110W routers with specific firmware versions.

The vulnerability occurs because the lan_ipv6_prefixlen configuration parameter is retrieved from NVRAM and used in a command without proper sanitization before being passed to the system() function.

This improper sanitization allows an authenticated remote attacker to inject arbitrary OS commands that execute with root privileges.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to severe impacts including remote code execution with root privileges on the affected router.

An attacker can execute persistent commands that survive reboots by manipulating NVRAM configurations.

Incorrectly formatted payloads can permanently brick the device, requiring hardware chip re-flashing for recovery.

Overall, this vulnerability can result in complete compromise of the router's security.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the router's NVRAM configuration parameters related to IPv6 settings, specifically the values of lan_ip_mode and lan_ipv6_prefixlen.

• Verify if lan_ip_mode is missing or not set to "1".
• Check if lan_ipv6_prefixlen contains unexpected or malicious values that could be used for command injection.

Commands to inspect these parameters on the affected Cisco RV130 or RV110W routers might include accessing the router's command line interface and running commands to read NVRAM variables, such as:

• nvram get lan_ip_mode
• nvram get lan_ipv6_prefixlen

If these parameters are set to suspicious values (e.g., lan_ip_mode=0 and lan_ipv6_prefixlen=64), it may indicate exploitation or attempted exploitation of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include verifying and correcting the NVRAM configuration parameters to prevent command injection.

• Ensure that lan_ip_mode is set to "1" to avoid triggering the vulnerable code path.
• Validate and sanitize the lan_ipv6_prefixlen parameter to prevent malicious input.

Additionally, avoid using vulnerable firmware versions 1.0.3.55 for RV130 and 1.2.2.5 or 1.2.2.8 for RV110W routers. If possible, update to a firmware version where this vulnerability is patched.

Be cautious with any changes to network configuration parameters and monitor for unusual behavior such as unexpected reboots, which may indicate exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-24699 vulnerability allows an authenticated remote attacker to execute arbitrary OS commands with root privileges on affected Cisco routers, leading to complete compromise of the device's security.

Such a compromise can result in unauthorized access to sensitive data, disruption of network services, and potential data breaches, which may violate compliance requirements under standards like GDPR and HIPAA that mandate protection of personal and health information.

Therefore, this vulnerability poses a significant risk to maintaining compliance with these regulations due to the potential for data exposure and loss of system integrity.

Useful 0 Not Useful 0