CVE-2022-20801
Published: 04 May 2022
Summary
CVE-2022-20801 is a medium-severity Command Injection (CWE-77) vulnerability in Cisco Rv340 Firmware. Its CVSS base score is 4.7 (Medium).
Operationally, ranked in the top 24.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-20801 affects the web-based management interface of Cisco Small Business RV340 and RV345 routers. Multiple command-injection flaws in this interface stem from insufficient validation of user-supplied input and are tracked under CWE-77 and CWE-78. An authenticated attacker who supplies crafted input can execute arbitrary commands on the underlying Linux operating system of the device.
Exploitation requires valid Administrator credentials on the affected router. A successful attack allows the adversary to run commands remotely with the privileges of the web-management process, resulting in limited but direct control over the device configuration and data.
The Cisco Security Advisory cisco-sa-smb-rv-cmd-inj-8Pv9JMJD describes the issues and provides updated firmware that removes the input-validation weaknesses. Administrators are advised to apply the fixed releases and restrict administrative access to trusted networks.
EPSS for the CVE rose from a low baseline to a peak of 0.0522 on 2025-01-22 before receding to the current value of 0.0086, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26051
Vulnerability details
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due…
more
to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.