CVE-2026-24700 describes an OS command injection vulnerability in the start_lltd() function of the "rc" binary on Cisco RV130/RV130W routers running firmware 1.0.3.55 and RV110W routers running firmware 1.2.2.5 and 1.2.2.8. The vulnerability is due to improper sanitization of the machine_name configuration parameter, which can be exploited by an authenticated remote attacker to execute arbitrary operating system commands with root privileges. This could lead to full system compromise on affected devices. No CVSS score or vendor advisory is currently available, and no patch or mitigation guidance has been provided.

An authenticated remote attacker can exploit this vulnerability to execute arbitrary OS commands with root privileges on affected Cisco routers. This can lead to complete compromise of the device, including unauthorized control, data theft, or disruption of network services. The vulnerability affects specific firmware versions of Cisco RV130/RV130W and RV110W routers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device management interfaces to trusted users only and monitor for any suspicious activity. Avoid using the vulnerable firmware versions if possible.