CVE-2026-24699: OS Command Injection
An OS command injection vulnerability exists in the sub34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The lanipv6prefixlen configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remediate the OS command injection by applying the vendor patch/fix that corrects improper sanitization of the lan_ipv6_prefixlen configuration parameter used by the sub_34984() function in the rc binary.
Cisco RV130/RV130W (rc binary) lan_ipv6_prefixlen = properly sanitized (apply vendor fix)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24699?
CVE-2026-24699 has a high severity rating of 7.2 based on the CVSS 3.1 scoring system.
How do I fix CVE-2026-24699?
To fix CVE-2026-24699, you should update the firmware of affected Cisco RV110W and RV130/RV130W routers to the latest version available from Cisco.
What devices are affected by CVE-2026-24699?
CVE-2026-24699 affects Cisco RV110W routers with specific firmware versions 1.2.2.5 and 1.2.2.8, and Cisco RV130/RV130W routers with firmware version 1.0.3.55.
What type of vulnerability is CVE-2026-24699?
CVE-2026-24699 is categorized as an OS command injection vulnerability due to improper sanitization of the lan_ipv6_prefixlen configuration parameter.
Who is at risk from CVE-2026-24699?
Authenticated users with access to the affected Cisco devices may exploit CVE-2026-24699 to execute unauthorized commands.