Executive brief
An OS command injection vulnerability exists in several Cisco small business routers, including the RV110W and RV130 series. These devices are used to provide network connectivity and firewall services for small offices. An authenticated attacker can exploit this flaw to take full control of the router with administrative privileges, potentially leading to data interception, network disruption, or persistent access to the internal network.
Technical details
An OS command injection vulnerability exists in the save_syslog_to_file() function within the 'httpd' binary of Cisco RV110W, RV130, and RV130W routers. The vulnerability is caused by insufficient sanitization of the 'model_name' configuration parameter retrieved via nvram_get(). This parameter is subsequently used in a snprintf() call to construct a shell command string that is executed via system(). An authenticated remote attacker can inject malicious shell commands (e.g., using subshell syntax like $(command)) into the model_name parameter. Successful exploitation allows for arbitrary code execution with root privileges and can be made persistent across reboots by modifying the device configuration.
Affected products
- Cisco RV130 1.0.3.55
- Cisco RV130W 1.0.3.55
- Cisco RV110W 1.2.2.5, 1.2.2.8
Timeline
- 2026-07-08: disclosed: Vulnerability details published on GitHub and NVD