CVE-2022-20700

CVE-2022-20700 is a stack-based buffer overflow (CWE-121, also characterized as an out-of-bounds write, CWE-787) in the web management interface of Cisco Small Business RV series routers, disclosed as part of a batch of multiple vulnerabilities in the RV160, RV260, RV340, and RV345 series. A remote, unauthenticated attacker can trigger the flaw by sending crafted HTTP requests to the affected device's web UI; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no privileges or user interaction are required. Successful exploitation can allow arbitrary code or command execution with high impact on confidentiality, integrity, and availability, and the broader advisory also covers privilege elevation, authentication bypass, execution of unsigned software, and denial of service. Any RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, or RV345P running affected firmware is affected; these are typically small-business and branch-office internet gateways. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, confirming active exploitation (EPSS 5.7%, 93rd percentile), though no public proof-of-concept is known.

What to do: Apply Cisco's patched firmware to all affected RV160/160W/260/260P/260W/340/340W/345/345P routers per vendor instructions, as required by the CISA KEV listing. Until patched, restrict exposure of the routers' web management interface (limit to trusted management networks or VPN, disable remote web access) and prioritize internet-facing devices. Inventory deployed firmware versions against Cisco's advisory and review device logs for signs of exploitation.