CVE-2022-20705

What it actually does

CVE-2022-20705 is part of a set of critical Cisco Small Business RV160, RV260, RV340, and RV345 router vulnerabilities that can allow an unauthenticated network attacker to compromise the device. At a technical level, the flaws can enable arbitrary code execution, command execution, privilege escalation, authentication or authorization bypass, execution of unsigned software, and denial of service. Because the CVSS vector is network-accessible, low-complexity, unauthenticated, and requires no user interaction, exposed management or service interfaces on affected routers can be targeted remotely. Successful exploitation can result in full compromise of the router, loss of confidentiality and integrity for traffic and configuration data, and interruption of routing/VPN/security services.

Why it matters to the business

Compromise of an edge router can give an attacker control over a key network boundary device. Business consequences include internet or branch connectivity outages, VPN disruption, interception or redirection of traffic, theft of device credentials or configuration secrets, creation of persistent remote access, and use of the router as a foothold into internal networks. The EPSS score is high and exploit maturity is listed as weaponized, which means internet-exposed devices should be treated as high-priority even though this CVE is not currently listed in CISA KEV. These router models are common in small business and branch-office deployments, so unmanaged or forgotten appliances may remain exposed years after publication.

How an attack unfolds

An attacker typically scans for Cisco Small Business RV160, RV260, RV340, or RV345 Series Routers, especially devices exposing web management, VPN, or administrative services to the internet. After fingerprinting a vulnerable firmware family, the attacker sends crafted network requests to one or more vulnerable interfaces. Depending on the specific vulnerable component reached, exploitation may bypass authentication, trigger memory corruption, execute commands, upload or fetch unsigned software, or cause the device to crash. If code or command execution succeeds, the attacker can modify configuration, add accounts or keys, deploy malware, proxy traffic, harvest VPN or administrative credentials, pivot toward connected networks, or intentionally disrupt routing services. Because weaponized exploitation is reported, defenders should assume attacks may be automated and opportunistic against internet-facing devices.

How to fix it

Upgrade affected Cisco Small Business RV160, RV260, RV340, and RV345 Series Router firmware to a Cisco release that includes fixes for this advisory. Cisco advisories should be consulted for the exact fixed firmware release for each hardware model and variant, because fixed_versions were not provided in the input. If a device is end-of-life, unsupported, or cannot be upgraded, replace it with a supported model. Until upgraded or replaced, restrict management access to trusted administrative networks only, disable WAN-side administration, limit VPN and management exposure to known source IP addresses, enforce strong unique administrative credentials, disable unused services, and place the device behind additional filtering where feasible. After remediation, review configuration for unauthorized changes and rotate credentials, VPN pre-shared keys, API keys, and certificates that may have been exposed through router compromise.

How to confirm the fix worked

Confirm each deployed device model and firmware version against Cisco’s fixed-release guidance for the RV160, RV260, RV340, and RV345 families. Validate that remote management is not reachable from the public internet unless explicitly required and protected by strict source restrictions. Perform authenticated administrative checks to verify there are no unexpected local users, VPN profiles, port forwarding rules, DNS settings, static routes, startup tasks, uploaded packages, or configuration changes. Use external scanning from an untrusted network to confirm management interfaces are not exposed. Where vulnerability scanners have Cisco RV router checks available, run an authenticated or version-based scan and verify the finding is cleared after upgrade. Monitor device stability and logs after patching to ensure no recurring crashes or suspicious administrative activity remain.

Typical attack path

1. Scan the internet or target networks for Cisco RV160, RV260, RV340, RV345, and related wireless or PoE variants.
2. Fingerprint the device model and firmware through exposed management, VPN, HTTP/HTTPS, or other router services.
3. Send crafted unauthenticated network requests to a vulnerable service or management endpoint.
4. Bypass authentication or authorization, or trigger memory corruption to obtain command/code execution.
5. Execute arbitrary commands, change configuration, or fetch and run unsigned attacker-controlled software.
6. Establish persistence through configuration changes, added users, startup scripts, modified services, or implanted binaries where possible.
7. Use the compromised router to intercept traffic, steal credentials, pivot into connected networks, proxy malicious activity, or cause denial of service.

How to detect it

To determine whether exploitation already occurred, review router system logs, administrative audit logs, VPN logs, web-management access logs if available, firewall logs, DHCP/DNS logs, NetFlow, and upstream security telemetry covering the period before and after any suspected exposure. Look for unauthenticated or failed requests to management interfaces followed by successful administrative actions, configuration exports, firmware or package upload activity, unexpected reboots or crashes, and outbound connections from the router to unfamiliar IP addresses or domains. Investigate changes to local users, privilege levels, VPN accounts, port forwards, DNS resolver settings, dynamic DNS settings, static routes, firewall rules, certificates, and remote-management settings. Because small business routers often have limited logging and logs may be lost after reboot, correlate with perimeter firewall, ISP-facing flow data, remote access logs, and vulnerability scanner records. Treat evidence of abnormal management access, new unsigned software, unexplained configuration drift, or repeated service crashes as potential compromise and preserve the device image/configuration where feasible before reset or replacement.

• Cisco RV160
• Cisco RV160W
• Cisco RV260
• Cisco RV260P
• Cisco RV260W
• Cisco RV340
• Cisco RV340W
• Cisco RV345
• Cisco RV345P
• RV160
• RV160W
• RV260
• RV260P
• RV260W
• RV340
• RV340W
• RV345
• RV345P
• unexpected router reboot
• unexpected configuration change
• WAN remote management enabled
• new administrator account
• new VPN user
• modified DNS server
• new port forwarding rule
• unsigned software
• firmware upload

What your security team should do

• Immediately inventory all Cisco Small Business RV160, RV260, RV340, RV345, and variant devices, including branch, lab, and backup appliances.
• Prioritize internet-facing or VPN-terminating devices for firmware upgrade or replacement because the vulnerability is unauthenticated, network-exploitable, high severity, and weaponized.
• Disable WAN-side management and restrict administrative access to trusted IP ranges or a dedicated management network.
• Review router configurations for unauthorized users, altered DNS servers, new port forwards, unexpected VPN accounts, suspicious certificates, and modified routing rules.
• Rotate administrative passwords, VPN credentials, pre-shared keys, and other secrets stored on or used by affected routers after upgrade or replacement.
• Collect and preserve router logs, firewall logs, VPN logs, NetFlow, and upstream proxy/DNS telemetry before rebooting or factory-resetting suspected devices.
• If compromise is suspected, replace or factory-reset the router, reload a known-good configuration, upgrade firmware, and investigate connected networks for lateral movement.
• Add SIEM detections for external access to router management interfaces, unusual administrative logins, unexpected configuration changes, repeated crashes/reboots, and outbound connections from routers to unfamiliar infrastructure.
• Continuously scan external attack surface for exposed Cisco RV management services and verify remediations remain in place.