An OS command injection flaw exists in the save_syslog_to_file routine of the httpd process on certain Cisco routers. The function fails to sanitize the model_name parameter, allowing an authenticated remote attacker to run arbitrary commands with root privileges. This flaw falls under CWE‑78, indicating improper handling of operating system command interfaces.

Affected devices are Cisco RV130 and RV130W routers running firmware 1.0.3.55 and Cisco RV110W routers on firmware 1.2.2.5 or 1.2.2.8. The vulnerability is limited to these specific firmware builds and router models.

The CVSS score of 7.2 indicates a high severity vulnerability. The EPSS score of less than 1% shows that while exploitation probability is low, it is not zero. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate to the router’s web interface. Once authenticated, the unsanitized model_name parameter in the save_syslog_to_file function can be used to inject commands, allowing the attacker to execute arbitrary OS commands with root privileges.