Actively exploited in the wild
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
Cisco - Small Business RV160, RV260, RV340, and RV345 Series Routers · Listed in the CISA KEV since 2022-03-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-20700
CriticalCVSS 10.0KEVSummary
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
Risk Assessment
An attacker could take control of the router, execute arbitrary code or commands, bypass security mechanisms, and cause service disruption. This may lead to full compromise of the edge device and the network.
Recommendation
Apply the fixes provided by Cisco in the security advisory. If patches are unavailable, consider replacing the device or restricting access to the management interface.
Other vulnerabilities in Cisco Small Business RV Series Routers
See all- CVE-2022-20708CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
- CVE-2022-20703CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
- CVE-2022-20701CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
- CVE-2022-20699CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
Original NVD description (English source)
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.