CVE-2023-20117
published 2023-04-05CVE-2023-20117: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an…
PriorityP262high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
28.35%
97.9th percentile
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as the root user on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. Cisco has not released software updates to address these vulnerabilities.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | rv320_firmware | — | — |
| cisco | rv325_firmware | — | — |
| cisco | small_business_rv320_and_rv325_dual_gigabit_wan_vpn_routers | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco RV Series Router sys_setting.htm md5_password Parameter Command Injection Attempt (CVE-2023-20117)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:16; content:"/sys_setting.htm"; fast_pattern; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name|3d 22|md5_password|22|"; pcre:"/^.*(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24)|(?:telnetd\x20|sh|bash|wget\x20|curl\x20|cat\x20|ls\x20|IFS))+/R"; reference:url,www.iotsec-zone.com/article/383; reference:cve,2023-20117; classtype:web-application-attack; sid:2063622; rev:1; metadata:affected_product Cisco_RV_Series, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_07_21, cve CVE_2023_20117, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_21, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Exploit targets HTTP POST requests to /sys_setting.htm with a multipart form-data body containing the `md5_password` parameter; inspect the parameter value for shell metacharacters or command tokens. ↗
- →Flag injection attempts using shell metacharacters (`;`, newline `\x0a`, backtick, `|`, `$`) or common shell/utility tokens (telnetd, sh, bash, wget, curl, cat, ls, IFS) in the md5_password field, both raw and URL-encoded. ↗
- →Exploitation requires valid Administrator credentials; correlate command-injection alerts with prior successful admin-level authentication events on the management interface. ↗
- →Successful exploitation results in arbitrary command execution as root on the underlying Linux OS; monitor for unexpected root-level process spawning from the web server process on RV320/RV325 devices. ↗
- ·No software patch is available from Cisco; affected RV320/RV325 devices remain permanently vulnerable. Detection and network-level controls are the only mitigations. ↗
- ·The Snort/Suricata rule (sid:2063622) is scoped to plaintext HTTP traffic only (tls_state plaintext); if the management interface is accessed over HTTPS, the rule will not fire and TLS inspection must be in place. ↗
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_cisco7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
vendor_cisco·2023-04-05·CVSS 7.2
CVE-2023-20117 [HIGH] CWE-146 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device.
These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as the root user on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator
Cisco
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2023-20117 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
CVE-2023-20117: Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as the root user on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid
GHSA
GHSA-cg3w-xf55-wj9x: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an aut
ghsa_unreviewed·2023-04-05
CVE-2023-20117 [HIGH] CWE-78 GHSA-cg3w-xf55-wj9x: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an aut
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as the root user on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. Cisco has not released software updates to address these vulnerab
Suricata
ET WEB_SPECIFIC_APPS Cisco RV Series Router sys_setting.htm md5_password Parameter Command Injection Attempt (CVE-2023-20117)
suricata·2025-07-21·CVSS 7.2
CVE-2023-20117 [HIGH] ET WEB_SPECIFIC_APPS Cisco RV Series Router sys_setting.htm md5_password Parameter Command Injection Attempt (CVE-2023-20117)
ET WEB_SPECIFIC_APPS Cisco RV Series Router sys_setting.htm md5_password Parameter Command Injection Attempt (CVE-2023-20117)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco RV Series Router sys_setting.htm md5_password Parameter Command Injection Attempt (CVE-2023-20117)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:16; content:"/sys_setting.htm"; fast_pattern; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name|3d 22|md5_password|22|"; pcre:"/^.*(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24)|(?:telnetd\x20|sh|bash|wget\x20|curl\x20|cat\x20|ls\x20|IFS))+/R"; reference:url,www.iotsec-zone.com/article/383; reference:cve,2023-20117; classtype:web-application-attack; sid:2063622; rev:
No public exploits indexed.
No writeups or analysis indexed.
2023-04-05
Published