CVE-2022-20699

What it actually does

CVE-2022-20699 is part of a set of critical vulnerabilities affecting Cisco Small Business RV160, RV260, RV340, and RV345 Series routers. The advisory describes improper input validation and related flaws that can allow an unauthenticated remote attacker to execute arbitrary code or commands, elevate privileges, bypass authentication and authorization controls, fetch and run unsigned software, or cause denial of service. With a CVSS score of 9.8 and network-based, low-complexity, no-authentication exploitation characteristics, successful exploitation can provide full compromise of the affected router, including confidentiality, integrity, and availability impact.

Why it matters to the business

These routers commonly sit at the network edge, so compromise can expose internal traffic, enable unauthorized network access, disrupt connectivity, and provide attackers with a persistent foothold for lateral movement. Because this vulnerability is listed in CISA KEV, has known in-the-wild exploitation, and carried a federal remediation due date of 2022-03-17, any remaining exposed device should be treated as high-risk and overdue for remediation. Operational consequences can include branch outage, VPN compromise, data interception, credential theft, malware staging, and loss of trust in perimeter controls.

How an attack unfolds

An attacker scans the internet or targeted address ranges for exposed Cisco Small Business RV-series router management or VPN services. They send crafted network requests that trigger vulnerable input-handling paths in the device firmware. Depending on the specific vulnerable component reached, the attacker may bypass authentication, execute commands or code with elevated privileges, upload or fetch unsigned software, modify configuration, or crash the device. After gaining control, the attacker can create or modify administrative access, change DNS or routing settings, capture traffic, proxy attacks into the internal network, stage additional malware, or intentionally cause denial of service. Because exploitation is documented as active in the wild and the issue is in CISA KEV, defenders should assume internet-exposed unpatched devices are credible targets.

How to fix it

Upgrade affected Cisco Small Business RV-series routers to a Cisco firmware release that addresses the February 2022 advisory for the RV160, RV260, RV340, and RV345 Series. No fixed versions were provided in the input, so validate the exact target firmware against Cisco’s official advisory and software download portal for the specific model, including RV340, RV340W, RV345, and RV345P variants. If a fixed release is unavailable for a deployed model, replace the device or remove it from internet exposure. Disable WAN-side management and restrict administrative access to trusted management networks or VPN-only access. Review and harden VPN, DNS, routing, and administrative account configuration after patching. Reboot and verify firmware integrity after upgrade. For devices suspected of compromise, perform factory reset, reinstall trusted firmware, rotate all router, VPN, and downstream credentials that may have traversed the device, and review network routes, firewall rules, DNS settings, certificates, and user accounts.

How to confirm the fix worked

Confirm every affected router model and firmware version against Cisco’s advisory and ensure the installed firmware is a fixed release. Verify that remote administration from the internet is disabled unless explicitly required and protected by strict source-IP allowlisting and strong authentication. From an external network perspective, confirm that management interfaces are not reachable on WAN-facing addresses. Review device configuration for unexpected administrator accounts, modified VPN users, altered DNS servers, new port-forwarding rules, unusual static routes, disabled logging, or unauthorized firmware/package changes. Conduct a controlled vulnerability scan with authenticated version checks where possible; avoid intrusive exploit validation on production routers because some exploit paths can cause denial of service. Where compromise is suspected, validate by comparing running configuration and firmware hashes against known-good baselines and Cisco-provided images.

Typical attack path

1. Identify internet-exposed Cisco RV160, RV260, RV340, or RV345 Series router services such as web administration, VPN, or remote management interfaces.
2. Fingerprint firmware/model information from banners, login pages, TLS certificates, HTTP responses, or device-specific endpoints.
3. Send crafted unauthenticated requests to the vulnerable service to trigger improper input validation and achieve authentication bypass, command execution, code execution, or denial of service.
4. Establish control by changing configuration, adding administrative access, retrieving sensitive configuration, or fetching and running attacker-controlled unsigned software.
5. Use the compromised router as a foothold to monitor or redirect traffic, access VPN-connected networks, scan internal systems, or launch follow-on attacks.
6. Cover tracks by clearing logs where possible, disabling security features, modifying management access, or blending activity into normal administrative traffic.

How to detect it

Review router system logs, web administration logs, VPN logs, configuration-change logs, firewall/NAT logs, and upstream network telemetry for signs of unauthorized access or post-exploitation activity. Focus on failed and successful administrative logins from unfamiliar public IP addresses, unexpected configuration changes, firmware update events, new or modified administrator or VPN users, altered DNS servers, new port forwarding or static routes, disabled logging, and unexplained reboots or crashes. Network telemetry should be checked for scanning, command-and-control-like outbound connections from the router, unusual DNS queries, connections to rare external hosts, and lateral movement from the router toward internal systems. Because device logs may be limited or tampered with, correlate router events with firewall, VPN concentrator, DNS resolver, NetFlow, proxy, and EDR telemetry on internal systems. For incident response, collect the running configuration, startup configuration, firmware version, user/account list, VPN configuration, DNS and routing settings, NAT/port-forward rules, system uptime, crash logs, and any available audit logs before factory reset or reimaging.

• Cisco RV340
• Cisco RV340W
• Cisco RV345
• Cisco RV345P
• RV340 firmware
• RV340W firmware
• RV345 firmware
• RV345P firmware
• firmware upgrade
• configuration changed
• admin login
• login failed
• user added
• user deleted
• password changed
• DNS server changed
• static route added
• port forwarding added
• VPN user added
• remote management enabled
• logging disabled
• unexpected reboot
• system restarted
• segmentation fault
• crash
• core dump

What your security team should do

• Immediately identify all Cisco Small Business RV160, RV260, RV340, RV345, RV340W, and RV345P devices, especially those with internet-exposed management, VPN, or administrative services.
• Prioritize remediation as emergency work for any exposed device because the vulnerability is critical, listed in CISA KEV, actively exploited in the wild, and long past the 2022-03-17 KEV due date.
• Upgrade to the Cisco-recommended fixed firmware for each exact model, or replace devices that cannot be upgraded to a supported fixed release.
• Disable WAN-side management and restrict router administration to trusted management networks with source-IP restrictions and strong authentication.
• Review router configurations for unauthorized accounts, altered DNS or routing, unexpected port forwards, VPN changes, and disabled logging.
• If exploitation cannot be ruled out, factory reset the device, reinstall trusted firmware, rotate administrative and VPN credentials, and treat the router as a potentially compromised perimeter asset.
• Add monitoring for configuration changes, administrative logins, firmware updates, unexpected outbound connections from the router, and internal scanning originating from the router.
• Preserve logs and configuration backups before remediation when feasible to support forensic review.