# CVE-2026-24698: Cisco RV110W and RV130 OS command injection in httpd

Source: https://junglewise.ai/threats/cve-2026-24698-cisco-rv110w-and-rv130-os-command-injection-in-httpd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-24698 · Severity: info · CVSS 8.8 · Published 2026-07-08

An OS command injection vulnerability exists in several Cisco small business routers, including the RV110W and RV130 series. These devices are used to provide network connectivity and firewall services for small offices. An authenticated attacker can exploit this flaw to take full control of the router with administrative privileges, potentially leading to data interception, network disruption, or persistent access to the internal network.

Technologies: [Cisco RV110W](https://junglewise.ai/threats/technologies/rv110w). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-24698 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24698 being exploited in the wild.

**How severe is CVE-2026-24698?** Informational severity, with a CVSS score of 8.8, published 8 July 2026.

**Which products and versions are affected?** Cisco RV110W 1.2.2.5, 1.2.2.8; Cisco RV130 1.0.3.55; Cisco RV130W 1.0.3.55.

**Is there a fix for CVE-2026-24698?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24698 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-24698?** Check whether you run Cisco RV110W, Cisco RV130 or Cisco RV130W at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the save_syslog_to_file() function within the 'httpd' binary of Cisco RV110W, RV130, and RV130W routers. The vulnerability is caused by insufficient sanitization of the 'model_name' configuration parameter retrieved via nvram_get(). This parameter is subsequently used in a snprintf() call to construct a shell command string that is executed via system(). An authenticated remote attacker can inject malicious shell commands (e.g., using subshell syntax like $(command)) into the model_name parameter. Successful exploitation allows for arbitrary code execution with root privileges and can be made persistent across reboots by modifying the device configuration.

## Affected products

- Cisco RV130 1.0.3.55
- Cisco RV130W 1.0.3.55
- Cisco RV110W 1.2.2.5, 1.2.2.8

## Timeline

- 2026-07-08: disclosed: Vulnerability details published on GitHub and NVD

## References

- [https://github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/3/wp-en.md](https://github.com/glkfc/IoT-Vulnerability/blob/main/cisco/RV130/3/wp-en.md)