Cisco Small Business RV Series Routers Vulnerabilities (CVE-2022-20703)
Published In CISA KEV since Sources: CVE.org
What is affected, what to do
A stack-based buffer overflow vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers allows an attacker to execute arbitrary code, escalate privileges, bypass authentication, and cause a denial of service. The vulnerability is actively exploited and listed in the CISA KEV catalog. Affected products include specific firmware versions of these routers. Immediate patching to the latest firmware version is critical to mitigate the risk.
The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- Cisco Rv340 Firmware
lte *..1.0.03.24 - Cisco Rv340w Firmware
lte *..1.0.03.24 - Cisco Rv345 Firmware
lte *..1.0.03.24 - Cisco Rv345p Firmware
lte *..1.0.03.24 - Cisco Rv160 Firmware
lte *..1.0.01.05 - Cisco Rv160w Firmware
lte *..1.0.01.05 - Cisco Rv260 Firmware
lte *..1.0.01.05 - Cisco Rv260p Firmware
lte *..1.0.01.05 - Cisco Rv260w Firmware
lte *..1.0.01.05
- Cisco Rv340 Firmware
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
10.0
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: Vendor (CNA), CVSS v3
10.0
CVSS v3
Severity Critical on the scale from 0 to 10.
Source: CVE.org
9.2 %
EPSS score
Moderate — model estimates 1-10% exploitation likelihood.
Source: FIRST EPSS, percentile 95.4
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 223.15 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploited
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 10.0 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 10.0
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 9.2 %
- Moderate — model estimates 1-10% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 95.4
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- CISA assessment (SSVC)
- Exploitation: active · automatable · Technical impact: total
- Source: CISA Vulnrichment, as of 29 October 2024
CWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-121
Response and mitigation
Why act now?
Prioritisation rationale
This flaw is part of a batch of critical defects in the Cisco RV family. It allows unsigned software to run, which gives an attacker persistent control of a perimeter device, with full impact on confidentiality, integrity and availability. No authentication or complex preconditions are needed, but the attacker requires adjacent-network access and user interaction. Exploitation likelihood is high relative to most CVEs, and CISA has not flagged ransomware use. Typical targets are branch offices, retail sites and small locations where these routers act as the VPN and internet gateway. If the router is the perimeter or VPN endpoint of an NIS2-relevant site, treat remediation as high priority within days; where management access is already tightly segmented, an expedited regular patch cycle is acceptable.
Runbook step 1
Immediate response (0-24 h)
- Inventory: Find every Cisco Small Business RV160/RV160W, RV260/RV260P/RV260W, RV340/RV340W and RV345 on the network, e.g. via CMDB, DHCP leases, MAC OUI matching and scans for the web admin UI on TCP 443/8443. Read the firmware version on each device. The context lists 1.0.01.05 (RV160/RV260 family) and 1.0.03.24 (RV340/RV345 family) as affected.
- Upgrade the firmware: A fix is available from the vendor — look up the fixed release in the vendor advisory. Download images only from cisco.com and verify the checksum before flashing, because this flaw undermines software signature verification.
- Disable remote access: Until upgraded, turn off "Remote Management" on the WAN interface. Allow the web UI only from a dedicated management network or admin jump hosts.
- Check integrity: On devices that were previously exposed, compare the running firmware version, configuration and user accounts against your documented baseline. If anything deviates, take the device out of service, reflash it from a trusted image and restore a verified configuration backup.
- Rotate credentials: Rotate admin passwords, VPN pre-shared keys and any local VPN or RADIUS credentials stored on affected units, especially where compromise cannot be ruled out.
Runbook step 2
Mitigation layers
- Network segmentation: The attack vector is the adjacent network, so use ACLs to block guest Wi-Fi, IoT and client VLANs from reaching the router's management interface. Only the management VLAN should reach TCP 443/8443 and SSH on the router's LAN IP.
- Configuration hardening: Disable unused services such as UPnP, Cisco Plug and Play (PnP), remote management and any VPN services you don't use. Prevent automatic firmware or signature fetching from untrusted sources.
- User interaction: Exploitation requires user interaction. Admins should not open router UI links from email or chat. Use a separate browser profile or a privileged access workstation (PAW) for device administration.
- IPS/firewall: On the upstream firewall or IPS, enable available vendor signatures for the RV series (Snort/Talos "cisco-sa-smb" or SERVER-WEBAPP Cisco RV rules). Permit firmware uploads (HTTP POST with large multipart bodies) to router management IPs only from approved admin sources.
- Replacement planning: Review SMB routers deployed at KRITIS or NIS2-scoped sites. Where timely patching isn't feasible, replace them with a centrally managed enterprise firewall and demote the RV to a pure transit device.
Runbook step 3
Detection rules
- Router syslog: Forward RV logs to the SIEM (syslog UDP/TCP 514) and alert on firmware upgrade or image change events, reboots outside maintenance windows and newly created admin users. Example SPL:
index=network sourcetype=cisco:rv ("firmware" OR "upgrade" OR "reboot" OR "user added") | stats count by host, _time - Management access: In firewall or Zeek telemetry (
conn.log), flag connections to TCP 443/8443 on the router LAN IP from non-admin subnets. Sigma shape:dst_ip in router_mgmt_ips AND dst_port in (443,8443) AND NOT src_ip in admin_subnets - Traffic originating from the router: Outbound HTTP, TFTP or SSH sessions originating from the router itself (not forwarded traffic) to unknown destinations suggest payload retrieval or C2. Example KQL:
CommonSecurityLog | where SourceIP in (router_ips) and DestinationPort in (69,80,443,22) and DestinationIP !in (known_cisco_update) - Config drift: Periodically pull the running config and firmware version (SSH or scheduled backup export) and compare hashes against the baseline. Investigate any change.
- Availability: Correlate unexpected reboots or web UI outages (a possible DoS side effect) using SNMP or ICMP monitoring.
- Router syslog: Forward RV logs to the SIEM (syslog UDP/TCP 514) and alert on firmware upgrade or image change events, reboots outside maintenance windows and newly created admin users. Example SPL:
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)
Vendors and products
Affected operating systems
| Other | cisco | rv160_firmware | — |
| Other | cisco | rv160w_firmware | — |
| Other | cisco | rv260_firmware | — |
| Other | cisco | rv260p_firmware | — |
| Other | cisco | rv260w_firmware | — |
| Other | cisco | rv340_firmware | — |
| Other | cisco | rv340w_firmware | — |
| Other | cisco | rv345_firmware | — |
| Other | cisco | rv345p_firmware | — |
Weakness classes (CWE)
CWE-121Stack-based Buffer Overflow
Variant
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Entry at MITRE CWE-121
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited |
References & sources
- tools.cisco.com20220203 Cisco Small Business RV Series Routers VulnerabilitiesVendor advisory, x_refsource_CISCO, Vendor advisory
- zerodayinitiative.comadvisories/ZDI-22-408x_refsource_MISC, Third-party advisory, Vulnerability database
- zerodayinitiative.comadvisories/ZDI-22-413x_refsource_MISC, Third-party advisory, Vulnerability database
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20703government-resource, US government resource
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2022-20703"><img src="https://intel.neosec.eu/badge/cve/CVE-2022-20703.svg?lang=en" alt="CVE-2022-20703 – NEOSEC Intel" height="20"></a>