CVE-2022-20700

What it actually does

CVE-2022-20700 is a remotely reachable stack-based buffer overflow affecting Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers and related firmware variants. Because the flaw is network-accessible, low-complexity, and requires no authentication or user interaction, an attacker can send crafted input to the vulnerable router service and corrupt process memory. Successful exploitation can allow arbitrary code or command execution on the appliance, privilege escalation, authentication or authorization bypass, installation or execution of untrusted software, configuration tampering, traffic interception, or denial of service. As an internet-edge router vulnerability, compromise can also give an attacker a foothold at the network perimeter.

Why it matters to the business

Exploitation can result in full compromise of small-office or branch-office routing infrastructure, allowing attackers to disrupt connectivity, alter routing or firewall rules, capture or redirect traffic, enable unauthorized VPN or remote access, and use the router as a launch point into internal systems. This vulnerability is listed in CISA KEV, has documented exploitation in the wild, and the federal remediation deadline was 2022-03-17, so unremediated devices should be treated as high-risk legacy exposure even though the EPSS score is moderate. Because these devices often sit at the network edge and may not have mature endpoint telemetry, compromise can persist unnoticed and materially affect business continuity and confidentiality.

How an attack unfolds

An attacker first identifies an exposed Cisco RV160, RV260, RV340, or RV345 Series router, typically by scanning internet-facing management, VPN, or web service ports and fingerprinting the Cisco RV web interface or firmware. The attacker then sends a specially crafted request or payload to the vulnerable service that mishandles input length and overwrites stack memory. If the exploit succeeds, the attacker gains code execution or control over the affected process and can execute commands in the context available to the router service. From there, the attacker may modify configuration, add or change administrative access, enable remote management or VPN access, fetch and run additional unsigned tooling, redirect traffic, disable security controls, or crash and reboot the appliance to cover activity or cause operational disruption. Because exploitation has been observed in the wild and the device is perimeter-facing, post-exploitation should be assumed to include reconnaissance of internal networks and attempts to maintain access through configuration changes.

How to fix it

Upgrade all affected Cisco Small Business RV160, RV260, RV340, and RV345 Series router firmware to a Cisco release that fixes CVE-2022-20700 and the associated advisory vulnerabilities. No fixed versions were provided in the input, so validate the exact target firmware against Cisco’s official security advisory for the specific model: RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, or RV345P. If a device is end-of-life or cannot receive a fixed firmware image, replace it. Until patched or replaced, restrict WAN-side access to management and VPN interfaces, disable remote management from untrusted networks, allow management only from trusted administrative IP ranges, place the device behind additional filtering where feasible, rotate administrative credentials, review and harden VPN and firewall configuration, and reboot only after preserving logs and configuration evidence if compromise is suspected.

How to confirm the fix worked

Confirm the exact hardware model and firmware version on each Cisco RV160, RV260, RV340, and RV345 Series device and compare it with Cisco’s fixed firmware guidance. Verify that remote management interfaces are not exposed to the public internet unless strictly required and protected by access control. Perform an external scan to confirm that management, web administration, and VPN services are not reachable from untrusted networks beyond intended exposure. Validate that router configuration has not been altered unexpectedly, including administrator accounts, VPN users, port forwarding rules, firewall rules, DNS settings, static routes, remote management settings, and firmware image integrity. After upgrading, confirm the device reports the expected firmware version, services restart cleanly, and no recurring crashes or unexpected reboots occur.

Typical attack path

1. Scan for internet-exposed Cisco Small Business RV160, RV260, RV340, or RV345 Series routers and fingerprint vulnerable firmware or exposed management/VPN services.
2. Send crafted network input to the vulnerable router service to trigger stack memory corruption.
3. Achieve arbitrary code or command execution, authentication bypass, privilege escalation, or service crash depending on exploit reliability and target firmware.
4. Run commands on the appliance, alter configuration, create or modify access paths, or fetch and execute additional tooling.
5. Use the compromised router to intercept or redirect traffic, enable unauthorized remote access, pivot toward internal systems, or cause denial of service.
6. Remove or overwrite logs where possible and rely on limited appliance telemetry to evade detection.

How to detect it

Look for evidence across router syslog, administrative audit logs, VPN logs, firewall/NAT logs, configuration backups, NetFlow or firewall telemetry, upstream proxy logs, and external scanning telemetry. Indicators of prior exploitation may include unexpected device crashes or reboots, web management process failures, unusual requests to management or VPN interfaces, successful or failed administrative logins from unfamiliar internet addresses, new or modified administrator or VPN users, unexplained changes to firewall rules, NAT rules, DNS servers, static routes, port forwards, remote management settings, certificates, or firmware images. Because router telemetry may be limited, compare current configuration to a known-good backup and review surrounding network telemetry for the router initiating unusual outbound connections or scanning internal addresses. For devices exposed during the KEV exploitation window, assume logs may be incomplete and prioritize configuration integrity review and credential rotation. Threat hunting should include traffic from the router to unfamiliar external infrastructure, new inbound management access patterns, and signs that the router was used as a pivot into internal services.

• Cisco RV160
• Cisco RV160W
• Cisco RV260
• Cisco RV260P
• Cisco RV260W
• Cisco RV340
• Cisco RV340W
• Cisco RV345
• Cisco RV345P
• RV160 firmware
• RV260 firmware
• RV340 firmware
• RV345 firmware
• stack-based buffer overflow
• Segmentation fault
• segfault
• stack smashing detected
• httpd
• sslvpnd
• unexpected reboot
• firmware upgrade
• configuration changed
• remote management enabled
• new administrator user
• new VPN user

What your security team should do

• Treat any unpatched Cisco RV160, RV260, RV340, or RV345 Series router as urgent because the vulnerability is in CISA KEV, exploitation is active in the wild, and the remediation deadline has long passed.
• Inventory all Cisco Small Business RV Series routers, including branch, lab, small-office, and third-party-managed locations, and identify firmware versions.
• Patch to the vendor-fixed firmware immediately or replace devices that cannot be updated.
• Block public access to administrative interfaces and restrict VPN or management exposure to known trusted sources wherever operationally possible.
• Review router configurations for unauthorized changes, especially admin users, VPN accounts, firewall rules, port forwards, DNS servers, static routes, remote logging settings, and remote management enablement.
• Collect and preserve device logs, configuration backups, and network telemetry before rebooting or factory resetting any suspected compromised appliance.
• Rotate router administrator passwords, VPN credentials, and any secrets stored on or transiting through potentially compromised devices.
• Monitor for unexpected outbound connections, management logins from unusual IP addresses, repeated crashes, firmware changes, and traffic redirection patterns.
• If exploitation is suspected, isolate or replace the appliance, rebuild configuration from a known-good source, and conduct internal network threat hunting for follow-on activity.