CVE-2022-20703

CVE-2022-20703 is a stack-based buffer overflow (CWE-121), catalogued alongside an improper certificate validation issue (CWE-295), in the web-based management interface of Cisco Small Business RV160, RV260, RV340, and RV345 Series routers. Per the CVSS vector, an unauthenticated attacker positioned on an adjacent network segment can trigger the flaw by sending crafted requests to the device's management interface, with user interaction required; successful exploitation can yield arbitrary code execution, arbitrary command execution, privilege elevation, bypass of authentication and authorization controls, unsigned firmware execution, or denial of service. Any organization running unpatched firmware on RV160/RV160W, RV260/RV260P/RV260W, RV340/RV340W, RV345/RV345P routers is affected, particularly sites that expose the management interface beyond trusted LAN segments. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, one day after Cisco's advisory, confirming active exploitation in the wild; no public proof-of-concept is known, ransomware use is unconfirmed, and EPSS assigns a 9.2% 30-day exploitation probability (95th percentile).

What to do: Upgrade all RV160/RV160W, RV260/RV260P/RV260W, RV340/RV340W and RV345/RV345P units to the fixed firmware released with Cisco's March 2022 RV Series advisory, following the vendor's update instructions, as required by the CISA KEV action deadline. Until patched, restrict the web-based management interface to trusted management networks and do not expose it to the WAN or internet. Audit internet-facing and branch-office devices for signs of exploitation, since this flaw is confirmed to be actively exploited and no public workaround is documented.