CVE-2026-24699

HighCVSS 7.2/10Last modified Jul 10, 2026

Description

An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The lan_ipv6_prefixlen configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Jul 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-24704.3The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions upCVE-2026-247007.2An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 anCVE-2026-247088.2An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a rooCVE-2026-24717.5The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserializatCVE-2026-247106.1Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.CVE-2026-247115.3Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.CVE-2026-247127.3Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.CVE-2026-247139.8Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.CVE-2026-247148.7Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the boxCVE-2026-247155.3An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attaCVE-2026-247167.2A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2026-247176.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrat