CVE-2022-20700

Deeper analysis

Multiple vulnerabilities affect Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers and are tracked under CVE-2022-20700. The issues include stack-based buffer overflows and out-of-bounds writes that can be triggered over the network, leading to outcomes such as arbitrary code execution, privilege escalation, command execution, authentication bypass, execution of unsigned software, and denial of service. The vulnerabilities carry a maximum CVSS score of 10.0.

An unauthenticated remote attacker can exploit the flaws by sending specially crafted network requests to affected devices, achieving any of the impacts listed above without requiring user interaction or prior credentials.

The Cisco Security Advisory recommends applying the vendor-supplied firmware updates for each affected router model and following the configuration hardening steps outlined in the advisory. The entry also appears in the CISA Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.

EPSS scores for this CVE rose from a low baseline to a peak of 0.3221, indicating that exploitation interest increased after public disclosure and that the issue merits renewed attention.