Vulnerability Details CVE-2026-24699
An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The lan_ipv6_prefixlen configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.01
EPSS Ranking 57.3%
CVSS Severity
CVSS v3 Score 7.2
References
Products affected by CVE-2026-24699
-
cpe:2.3:h:cisco:rv110w:-
-
cpe:2.3:h:cisco:rv130:-
-
cpe:2.3:h:cisco:rv130w:-
-
cpe:2.3:o:cisco:rv110w_firmware:1.2.2.5
-
cpe:2.3:o:cisco:rv110w_firmware:1.2.2.8
-
cpe:2.3:o:cisco:rv130_firmware:1.0.3.55
-
cpe:2.3:o:cisco:rv130w_firmware:1.0.3.55