Cisco Small Business RV Series Routers Vulnerabilities (CVE-2022-20700)
Published In CISA KEV since Sources: CVE.org
What is affected, what to do
A stack-based buffer overflow vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers allows an attacker to execute arbitrary code, escalate privileges, bypass authentication, and cause a denial of service. These vulnerabilities are actively exploited in the wild. Affected products include specific firmware versions of the RV160, RV260, RV340, and RV345 models. Immediate patching to the latest firmware version is critical to mitigate these risks.
The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- Cisco Rv340 Firmware
lte *..1.0.03.24 - Cisco Rv340w Firmware
lte *..1.0.03.24 - Cisco Rv345 Firmware
lte *..1.0.03.24 - Cisco Rv345p Firmware
lte *..1.0.03.24 - Cisco Rv160 Firmware
lte *..1.0.01.05 - Cisco Rv160w Firmware
lte *..1.0.01.05 - Cisco Rv260 Firmware
lte *..1.0.01.05 - Cisco Rv260p Firmware
lte *..1.0.01.05 - Cisco Rv260w Firmware
lte *..1.0.01.05
- Cisco Rv340 Firmware
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
10.0
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: Vendor (CNA), CVSS v3
10.0
CVSS v3
Severity Critical on the scale from 0 to 10.
Source: CVE.org
5.7 %
EPSS score
Moderate — model estimates 1-10% exploitation likelihood.
Source: FIRST EPSS, percentile 93.0
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 219.59 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploited
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 10.0 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 10.0
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 5.7 %
- Moderate — model estimates 1-10% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 93.0
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- CISA assessment (SSVC)
- Exploitation: active · automatable · Technical impact: total
- Source: CISA Vulnrichment, as of 29 October 2024
CWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-121
Response and mitigation
Why act now?
Prioritisation rationale
This flaw is reachable over the network without authentication or user interaction and gives an attacker full control of the device. It is part of a cluster of chainable RV Series bugs for which public exploit code emerged. Attackers mass-scan for exposed SOHO routers and use them as footholds into branch networks, as VPN backdoors, or as proxy and botnet nodes. Typical victims are branch offices, medical practices and small sites of mid-market firms. Exploitation likelihood is high, although CISA records no known ransomware use. Rate any unit with internet-facing management as critical and act immediately; rate internally-only reachable units as high.
Runbook step 1
Immediate response (0-24 h)
- Inventory: Locate every Cisco Small Business RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W and RV345 using CMDB records, DHCP leases, and scans for the Cisco OUI or the web login page. According to the context, firmware 1.0.01.05 (RV160/RV260) and 1.0.03.24 (RV340/RV345) are affected. Treat anything older as vulnerable too.
- Disable WAN remote management now: Turn off "Remote Management" in the web UI. Then verify externally (your own scan, or Shodan/Censys against your IP ranges) that the management interface is no longer reachable from the internet. It typically runs on TCP 443, often 8443, or a custom port.
- Upgrade firmware: A patch is available from the vendor — look up the fixed version in the Cisco Security Advisory covering the RV Series vulnerabilities (February 2022). Download only from the Cisco Software Center and verify the hash.
- Check for compromise before upgrading: Export the configuration and diff it against the last known-good baseline. Look for unknown admin accounts and for changes to VPN, port-forwarding, DNS or static-route settings. If anything is suspicious, treat the device as compromised: factory reset, flash the patched firmware, and rebuild the config by hand rather than restoring the backup.
- Rotate secrets: Change admin passwords, VPN PSKs, certificates and RADIUS/LDAP shared secrets on every affected unit. Prioritise any device whose management interface was exposed.
- Start replacement planning: Check the lifecycle status of SOHO routers in NIS2/KRITIS-relevant branch sites and schedule replacement where vendor support is ending.
Runbook step 2
Mitigation layers
- Network segmentation: Restrict the management UI to a dedicated admin VLAN or jump host. Use ACLs to block user, guest and IoT VLANs from reaching the router's LAN IP on TCP 80/443/8443.
- Perimeter ACL: If remote administration is unavoidable, allowlist explicit source IPs only. Preferably, permit access only through an upstream MFA-protected VPN and never directly on the WAN interface.
- IPS/WAF: On any upstream NGFW/IPS, enable the Snort/Talos signatures for the 2022 Cisco RV vulnerabilities (CVE-2022-20700 et al.; filter the rule feed on "Cisco RV"). Block oversized HTTP POST bodies and headers aimed at management endpoints.
- Device hardening: Disable unused services (UPnP, remote management, unused VPN protocols) and force HTTPS. Ship syslog to the central SIEM, because local logs cannot be trusted once a device is compromised.
- IAM/least privilege: Minimise local admin accounts and avoid default-style names such as "cisco" or "admin". Use centralised, logged authentication where supported.
Runbook step 3
Detection rules
- Perimeter/Zeek telemetry: Watch for inbound internet connections to the router's WAN management port, especially large HTTP POST requests. Zeek http.log example:
method == "POST" && request_body_len > 4096 && id.resp_h in $rv_wan_ips. - Router-originated egress: HTTP, TFTP or FTP downloads, or connections to unknown hosts, that originate from the router itself suggest unsigned payloads being fetched. KQL example:
CommonSecurityLog | where SourceIP in (rv_ips) and DestinationPort in (21,69,80,4444,8080) | summarize count() by DestinationIP. - Device syslog: Look for admin logins from unknown IPs, logins outside maintenance windows, unexpected reboots or web-server crashes (a sign of memory corruption or DoS), and config changes with no change ticket. Sigma shape:
logsource: syslog, product: cisco_rv; selection: message|contains: ["login", "config change"]; filter: src_ip in admin_net. - Suricata/IDS: Enable the ET and Talos Cisco RV exploit signatures. Escalate any alert whose destination is a router WAN or LAN IP as high priority.
- NetFlow anomalies: Flag new tunnels or SOCKS/proxy-like flows originating from the router. Compromised SOHO routers are routinely enrolled as relays in proxy networks.
- Perimeter/Zeek telemetry: Watch for inbound internet connections to the router's WAN management port, especially large HTTP POST requests. Zeek http.log example:
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)
Vendors and products
Affected operating systems
| Other | cisco | rv160_firmware | — |
| Other | cisco | rv160w_firmware | — |
| Other | cisco | rv260_firmware | — |
| Other | cisco | rv260p_firmware | — |
| Other | cisco | rv260w_firmware | — |
| Other | cisco | rv340_firmware | — |
| Other | cisco | rv340w_firmware | — |
| Other | cisco | rv345_firmware | — |
| Other | cisco | rv345p_firmware | — |
Weakness classes (CWE)
CWE-121Stack-based Buffer Overflow
Variant
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Entry at MITRE CWE-121
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited |
References & sources
- tools.cisco.com20220203 Cisco Small Business RV Series Routers VulnerabilitiesVendor advisory, x_refsource_CISCO, Vendor advisory
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20700government-resource, US government resource
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2022-20700"><img src="https://intel.neosec.eu/badge/cve/CVE-2022-20700.svg?lang=en" alt="CVE-2022-20700 – NEOSEC Intel" height="20"></a>