CVE-2022-20708

CVE-2022-20708 is a stack-based buffer overflow (CWE-121) in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers; it is one of a set of related flaws in these devices that also includes OS command injection (CWE-78). An attacker triggers it by sending crafted traffic to an affected router, which per the CVSS vector (AV:A/PR:L) requires an adjacent-network attacker with low privileges. Successful exploitation can fully compromise the device, allowing arbitrary code execution, privilege elevation, command execution, authentication bypass, fetching/running of unsigned software, or denial of service. Organizations running these small-business routers—typically small offices and branch sites—are affected. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03, and EPSS estimates a ~15% probability of exploitation within 30 days (96th percentile), though no public PoC is known.

What to do: Apply the fixed firmware released in Cisco's advisory for each affected model (RV160/260/340/345 series) per vendor instructions, as required by the CISA KEV listing. Until patched, restrict the routers' web management interface to trusted LAN access and remove it from direct internet exposure, and verify current firmware versions to identify unpatched units. Monitor device logs and CISA/EPSS reporting, since active exploitation is confirmed.