CVE-2022-20707

published 2022-02-10

CVE-2022-20707: Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute…

Priority P1 82 high 7.3 CVSS 3.1

AV N AC L PR N UI N S U C L I L A L

ITW EXPLOIT VulnCheck KEV

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_small_business_rv_series_router_firmware	—	—
cisco	rv340_firmware	<= 1.0.03.24	—
cisco	rv340w_firmware	<= 1.0.03.24	—
cisco	rv345_firmware	<= 1.0.03.24	—
cisco	rv345p_firmware	<= 1.0.03.24	—
cisco	small_business_rv_series_routers	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /form-file-upload↗

path /upload↗

path /tmp/websession/token/$cookie_sessionid↗

path /tmp/upload↗

path /www/cgi-bin/↗

filename jsonrpc.cgi↗

filename upload.cgi↗

filename blockpage.cgi↗

ip 127.0.0.1:9003↗

• → CVE-2022-20707 is a command injection vulnerability (CWE-77) exploitable via the web UI on Cisco RV160, RV260, RV340, and RV345 routers; chained with CVE-2022-20705 authentication bypass it allows unauthenticated RCE as www-data/root. ↗
• → Authentication bypass (CVE-2022-20705) abuses a session ID directory traversal against the /tmp/websession/token/ path; if the file exists the nginx deny flag is cleared, granting access to /upload and /form-file-upload without valid credentials. ↗
• → The exploit chain works on firmware versions 1.0.03.24 and below for RV340/RV345, and 1.0.01.05 and earlier for RV160/RV260; detection should flag these version strings in device banners or firmware update traffic. ↗
• → Monitor for unexpected HTTPS POST requests to /upload or /form-file-upload on Cisco RV-series routers, especially from WAN interfaces where remote management may be enabled. ↗
• → The uWSGI backend for file upload is bound to 127.0.0.1:9003; anomalous local connections to this port or unexpected processes spawned from the uwsgi worker may indicate post-exploitation activity. ↗

• · The /upload endpoint is only protected by checking for the existence of a session token file; the authentication bypass (CVE-2022-20705) exploits directory traversal in the cookie_sessionid value to satisfy this check without a real session. ↗
• · Remote management enabled on the WAN interface exposes the vulnerable web UI externally, significantly increasing attack surface for CVE-2022-20707. ↗
• · Not all CVEs in the advisory apply to all affected products; operators should consult the Cisco advisory to determine which specific vulnerabilities affect their device model and firmware version. ↗

CVSS provenance

nvd v3.1 7.3 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 10.0 CRITICAL

vendor_cisco 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121 CWE-787 CWE-269 CWE-285 CWE-295 CWE-347 CWE-362 CWE-434 CWE-552 CWE-754 CWE-77 CWE-785