CVE-2026-24697: OS Command Injection
An OS command injection vulnerability exists in the startbonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The wanhostname configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24697?
CVE-2026-24697 has a severity rating of high, with a CVSS score of 7.2.
How do I fix CVE-2026-24697?
To remediate CVE-2026-24697, ensure you update Cisco RV130, RV130W, or RV110W routers to the latest firmware version that addresses this vulnerability.
What type of vulnerability is CVE-2026-24697?
CVE-2026-24697 is an OS command injection vulnerability found in the start_bonjour() function of the rc binary.
Which devices are affected by CVE-2026-24697?
CVE-2026-24697 affects Cisco RV130, RV130W, and RV110W routers with specific firmware versions.
What are the potential impacts of CVE-2026-24697?
Exploitation of CVE-2026-24697 can result in unauthorized remote code execution due to improper sanitization of the wan_hostname configuration parameter.