CVE-2022-20701

CVE-2022-20701 is a stack-based buffer overflow (CWE-121, with an associated out-of-bounds write, CWE-787) in the firmware of Cisco Small Business RV160, RV260, RV340, and RV345 series routers, disclosed as part of a multi-vulnerability advisory that also covers flaws enabling arbitrary command execution, authentication bypass, unsigned-software execution, and denial of service. Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U), this particular flaw requires low-privileged local access with no user interaction and is triggered when the router's firmware mishandles crafted input, overwriting a stack buffer. A successful attacker can execute arbitrary code, elevate privileges to take control of the router, or crash the device. Any organization running the affected Cisco Small Business RV-series routers — including RV340, RV340W, RV345, and RV345P models — is affected, and these devices are widely used in small-office and SMB networks. The flaw is actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03 and EPSS assigns a 9.7% chance of exploitation within 30 days (95th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed.

What to do: Apply the firmware updates Cisco released for the RV160, RV260, RV340/RV340W, and RV345/RV345P series per the vendor advisory, as required by the CISA KEV entry (specific fixed-version numbers are not in the source data, so consult Cisco's advisory for the correct build). Restrict router management interfaces to trusted networks or VPN access and prioritize patching any internet-facing RV-series devices. Inventory your estate for these models and verify current firmware versions against Cisco's affected-products list before upgrading.