OS Command Injection in Cisco RV130/RV130W and RV110W Routers

Executive Summary

CVE-2026-24700 is a command injection vulnerability found in Cisco RV130 and RV110w routers running specific firmware versions. It exists in the start_lltd() function of the "rc" binary, where the machine_name configuration parameter is not properly sanitized. This improper sanitization allows an authenticated remote attacker to inject malicious OS commands by including special characters in the machine_name input.

Because the injected commands run with root privileges, an attacker can execute arbitrary commands on the device. The vulnerability affects the LLTD (Link Layer Topology Discovery) service and can be exploited persistently by modifying the configuration file, causing the malicious commands to execute every time the device reboots.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a complete compromise of the affected router's security. An attacker who successfully exploits it can execute arbitrary commands with root privileges remotely, potentially gaining full control over the device.

• Remote code execution on the router.
• Persistent malicious command execution by modifying configuration files.
• Potential disruption of network services or interception of network traffic.
• Loss of confidentiality, integrity, and availability of the router and connected network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the configuration for the presence of malicious or unexpected characters in the machine_name parameter, which is used by the start_lltd() function. Since the vulnerability involves command injection via this parameter, inspecting the configuration files for suspicious entries or command delimiters (such as semicolons) can help identify exploitation attempts.

Additionally, monitoring the router for unexpected command executions or unusual behavior related to the LLTD service may indicate exploitation.

Specific commands to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the affected routers to trusted and authenticated users only, as exploitation requires authentication.

Review and sanitize the machine_name configuration parameter to ensure it does not contain special characters that could be used for command injection.

If possible, update the router firmware to a version that addresses this vulnerability once available.

Monitor the device for signs of compromise, such as unexpected command executions or persistent changes in configuration.

Useful 0 Not Useful 0