Cisco Small Business RV Series Routers Vulnerabilities (CVE-2022-20699)

What is affected, what to do

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Cisco Rv340 Firmware lte *..1.0.03.24
• Cisco Rv340w Firmware lte *..1.0.03.24
• Cisco Rv345 Firmware lte *..1.0.03.24
• Cisco Rv345p Firmware lte *..1.0.03.24

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every Cisco Small Business RV340, RV340W, RV345 and RV345P, including branch offices, remote sites and home offices. Firmware is shown under Status and Statistics → System Summary. Firmware 1.0.03.24 is confirmed affected. The same advisory also covers RV160/RV260, so check those too.
   • Upgrade firmware: A patch is available from Cisco — look up the fixed release in the vendor advisory. Download only from software.cisco.com and verify the hash, since the advisory also covers loading unsigned software.
   • Disable SSL VPN until patched: The flaw sits in the SSL VPN (AnyConnect-compatible) gateway and is reachable from the internet without authentication. Turn it off under VPN → SSL VPN, or temporarily move remote access to IPsec or a different concentrator.
   • Kill WAN-side remote management: Disable Firewall → Basic Settings → Remote Web Management. Block the configured SSL VPN port and the HTTPS management ports (typically TCP 443/8443) on the WAN interface.
   • Assume compromise where exposed: Treat any unpatched device that had SSL VPN reachable from the internet as potentially compromised. Back up the config and diff it against a known-good baseline (users, port forwards, DNS servers, static routes). Rotate local admin and VPN credentials and PSKs. Factory-reset and reflash if anything looks off.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation / perimeter: If an upstream firewall exists, restrict the RV's SSL VPN port to known source ranges (geo- or allowlisting). Expose management interfaces only to a dedicated management VLAN.
   • IPS/WAF: Enable CVE-2022-20699 signatures on upstream IPS (search Cisco Talos/Snort and Suricata ET rulesets for "Cisco RV SSL VPN"). Additionally, alert on or block oversized HTTP headers and long Cookie/body fields sent to the SSL VPN endpoint.
   • Egress filtering: Limit connections initiated by the router itself to what it needs (NTP, DNS, Cisco update servers). Log and block anything else from the router's management IP to arbitrary internet destinations. This breaks second-stage payload downloads and botnet C2.
   • Configuration hardening: Disable unused services (UPnP, WAN-side Telnet/SSH, Bonjour). Set strong, unique admin passwords. Configure remote syslog to a central collector so logs survive a device reset.
   • Lifecycle: For KRITIS/NIS2-relevant sites, assess whether exposed SMB routers should be replaced with centrally managed firewalls that have a proper patch process. Record the decision in the risk register.
3. 03

   Runbook step 3

   Detection rules

   • Network telemetry (Zeek/Suricata): Look for HTTP/TLS sessions to the SSL VPN port with abnormally large request headers or bursts of failed handshakes. Zeek idea: http.log | where id.resp_h in rv_wan_ips and request_body_len > 4096. Correlate Suricata alerts whose msg contains "CVE-2022-20699".
   • Router-originated outbound traffic (NetFlow/firewall logs): Flag new destinations contacted by the router's own IP, especially HTTP/TFTP downloads, IRC-style ports or hosting-provider ASNs. SPL example: index=netflow src_ip IN (rv_*) NOT dest_port IN (53,123,443) | stats dc(dest_ip) by src_ip.
   • Device syslog: Watch for SSL VPN process crashes or restarts, unexpected reboots, new local users, config changes outside maintenance windows, and logins from unfamiliar IPs. Sigma shape: logsource: syslog, product: cisco_rv / keywords: ['sslvpn', 'segfault', 'reboot', 'user added'].
   • Config drift: Export the running config on a schedule and diff it against the baseline automatically. Changed DNS servers, new port forwards and extra VPN users are the key signals.
   • Exposure monitoring: Scan your own external IP ranges (Shodan/Censys queries or an ASM tool) for reachable RV SSL VPN login pages.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Cisco Rv340 Firmware
• Cisco Rv340w Firmware
• Cisco Rv345 Firmware
• Cisco Rv345p Firmware

Weakness classes (CWE)

• CWE-121Stack-based Buffer Overflow

  Variant

  A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

  Entry at MITRE CWE-121

References & sources

• tools.cisco.com20220203 Cisco Small Business RV Series Routers VulnerabilitiesVendor advisory, x_refsource_CISCO, Vendor advisory
• zerodayinitiative.comadvisories/ZDI-22-414x_refsource_MISC, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Ex…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20699government-resource, US government resource