Cisco Small Business RV Series Routers Vulnerabilities (CVE-2022-20701)

What is affected, what to do

A stack-based buffer overflow vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers allows an attacker to execute arbitrary code, escalate privileges, bypass authentication and authorization protections, execute unsigned software, and cause a denial of service. The vulnerability is actively exploited, including in ransomware campaigns since 2022. Affected products include firmware versions 1.0.03.24. Immediate patching to the latest firmware version is critical to mitigate this risk.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Cisco Rv340 Firmware lte *..1.0.03.24
• Cisco Rv340w Firmware lte *..1.0.03.24
• Cisco Rv345 Firmware lte *..1.0.03.24
• Cisco Rv345p Firmware lte *..1.0.03.24

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Locate every Cisco Small Business RV160, RV260, RV340, RV340W, RV345 and RV345P via CMDB, network scans and DHCP/ARP tables. Record the firmware version; RV34x devices on 1.0.03.24 are confirmed affected.
   • Upgrade firmware: A patch is available from Cisco. Look up the fixed version in the Cisco security advisory covering the RV Series vulnerabilities (February 2022). Only use signed images from Cisco's software download portal and verify the hash before flashing.
   • Disable remote management: Until patched, turn off WAN-side remote administration of the web UI over HTTPS under "Firewall → Basic Settings → Remote Web Management". Restrict management to a dedicated admin VLAN.
   • Rotate credentials: Exploitation requires a low-privileged account. Audit all local users on each device, delete unused accounts, and reset every password. This includes VPN users and RADIUS shared secrets.
   • Compromise check: For devices that were internet-reachable before patching, export the running config and diff it against a known-good baseline. Look for unknown accounts, changed DNS/NTP servers, new port forwards and new VPN profiles. If anything looks off, factory-reset the device, reflash the firmware and rebuild the config by hand.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Restrict ACL access to router management services (HTTPS/443 and any alternate admin port) to a jump-host subnet. Block user and guest VLANs from reaching router management.
   • Break the exploit chain: The advisory bundles several flaws, including authentication bypass, command injection and loading unsigned software, which chain into full takeover. Disable Plug and Play (PnP), unused SSL VPN services and Umbrella/cloud features unless they are operationally required.
   • IAM/least privilege: Eliminate shared accounts and keep user roles to the minimum needed. Centralise authentication via RADIUS with logging where possible, and remove guest accounts on the router itself.
   • Egress filtering: At the upstream perimeter, limit router-originated traffic to essentials (NTP, DNS, Cisco update endpoints). This hampers payload retrieval and C2 after privilege escalation.
   • Lifecycle: Flag small-business routers at KRITIS/NIS2-relevant sites as a risk in the asset register. Plan their replacement with centrally managed, regularly patched edge devices.
3. 03

   Runbook step 3

   Detection rules

   • Router syslog: Forward syslog to the SIEM and alert on low-privileged logins followed shortly by config changes or admin actions. Example SPL: index=network host=rv* ("login" OR "config") | transaction user maxspan=10m | where eventcount>3.
   • Zeek/Suricata: Flag HTTPS sessions to router management IPs from unauthorised networks. Example Zeek filter: conn.log id.resp_h in <router_mgmt_ips> and id.resp_p==443 and not id.orig_h in <admin_net>.
   • NetFlow/firewall: Watch for new outbound flows sourced from the router management IP, such as TFTP/69, HTTP downloads, odd high ports or connections to foreign ASNs. These are strong indicators of staged binaries or reverse shells.
   • Integrity drift: Diff exported configs against the baseline on a schedule and raise a ticket on any change. Also alert on unexpected reboots or firmware version changes outside maintenance windows.
   • Sigma shape: logsource: product=cisco_rv; detection: selection: msg|contains: ['user added','privilege','firmware upgrade']; condition: selection and not filter_change_window.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Cisco Rv340 Firmware
• Cisco Rv340w Firmware
• Cisco Rv345 Firmware
• Cisco Rv345p Firmware

Weakness classes (CWE)

• CWE-121Stack-based Buffer Overflow

  Variant

  A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

  Entry at MITRE CWE-121

References & sources

• tools.cisco.com20220203 Cisco Small Business RV Series Routers VulnerabilitiesVendor advisory, x_refsource_CISCO, Vendor advisory
• zerodayinitiative.comadvisories/ZDI-22-412x_refsource_MISC, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20701government-resource, US government resource