cbcvebase.
CVE-2022-20708
published 2022-02-10

CVE-2022-20708: Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute…

PriorityP182high8CVSS 3.1
AVAACLPRLUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-03-17
Exploited in the wild
EPSS
14.86%
96.3th percentile
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Affected

6 ranges
VendorProductVersion rangeFixed in
ciscocisco_small_business_rv_series_router_firmware
ciscorv340_firmware<= 1.0.03.24
ciscorv340w_firmware<= 1.0.03.24
ciscorv345_firmware<= 1.0.03.24
ciscorv345p_firmware<= 1.0.03.24
ciscosmall_business_rv_series_routers

Detection & IOCsextracted from sources · hover to see the quote

  • CVE-2022-20708 affects Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers; detection should focus on exploit attempts targeting these device families
  • Monitor for stack-based buffer overflow exploitation attempts (CWE-121) against the RV series router management interfaces
  • Monitor for authentication/authorization bypass attempts (CWE-285) on affected Cisco RV series routers, which could precede code execution or privilege escalation
  • Monitor for unsigned firmware/software fetch-and-run activity (CWE-347) on affected Cisco RV series routers, indicating possible supply-chain or update-hijack exploitation
  • Monitor for arbitrary file upload attempts (CWE-434) to affected Cisco RV series routers, which may be used to deliver malicious payloads
  • Cisco Bug IDs CSCvz88279, CSCvz94704, CSCwa12732 are associated with this CVE cluster; use these identifiers when cross-referencing Cisco TAC or PSIRT telemetry
  • ·This CVE is part of a broader multi-vulnerability advisory (cisco-sa-smb-mult-vuln-KA9PK6D) covering numerous CWEs across RV160, RV260, RV340, and RV345 series; detections should account for the full range of attack classes (buffer overflow, privilege escalation, command injection, improper cert validation, race condition, file upload, etc.)
  • ·CVSS score is listed as 3.1 (base score format), but the advisory covers critical-severity vulnerabilities; verify the full CVSS vector from Cisco's advisory before prioritizing patching

CVSS provenance

nvdv3.18.0HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
cisa8.0HIGH
vendor_cisco10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.