Executive brief
A security vulnerability exists in several Cisco small business routers used for networking and VPN connectivity. An authorized user could exploit this flaw to take full control of the device by injecting malicious commands into the system's configuration settings. This could lead to a complete compromise of the router, allowing an attacker to intercept network traffic or disrupt business operations.
Technical details
An OS command injection vulnerability exists in the start_lltd() function within the 'rc' binary of affected Cisco router firmware. The vulnerability is caused by a failure to sanitize the 'machine_name' NVRAM configuration parameter before it is passed to a sprintf() call that constructs a shell command. Specifically, the parameter is concatenated into a string ('echo \"%s\" > /proc/sys/kernel/hostname') which is then executed via the system() function. An authenticated remote attacker can exploit this by setting a malicious 'machine_name' containing shell metacharacters (e.g., backticks or semicolons) to achieve arbitrary code execution with root privileges.
Affected products
- Cisco RV130 VPN Firewall 1.0.3.55
- Cisco RV130W Wireless-N VPN Firewall 1.0.3.55
- Cisco RV110W Wireless-N VPN Firewall 1.2.2.5, 1.2.2.8
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory