Cisco Systems patched a critical vulnerability that could give an attacker root privileges to software running on two of its IoT router models.