CVE-2022-20707

What it actually does

CVE-2022-20707 is part of a Cisco Small Business RV Series router vulnerability set affecting RV340, RV340W, RV345, and RV345P devices. The flaws are remotely reachable, require no authentication or user interaction, and can allow an attacker to bypass authentication or authorization controls, execute arbitrary commands or code, elevate privileges, run unsigned software, or crash the device. At a technical level, successful exploitation can move an attacker from unauthenticated network access to control over the router management plane and potentially the underlying firmware/runtime environment. Because these routers often sit at the network edge, compromise can expose traffic flows, VPN connectivity, administrative functions, routing configuration, DNS settings, and firewall policy enforcement.

Why it matters to the business

Compromise of an affected router can disrupt internet or VPN connectivity, weaken perimeter security, expose internal network paths, and allow attackers to persist on or manipulate an edge device that many organizations do not monitor as closely as servers or endpoints. The high EPSS score and weaponized exploit maturity indicate meaningful real-world exploitability even though the vulnerability is not currently listed in CISA KEV. Since the issue affects small business edge routers and has been public for years, unpatched internet-facing devices should be treated as high-risk assets that may already have been scanned or targeted.

How an attack unfolds

An attacker first identifies an exposed Cisco RV340, RV340W, RV345, or RV345P management interface, commonly by scanning internet-facing HTTPS/HTTP services, VPN portals, or router-specific response fingerprints. Because exploitation does not require credentials, the attacker can send crafted requests to vulnerable management or service endpoints to trigger the underlying flaw. Depending on the vulnerable code path reached, the attacker may bypass authentication, execute commands, gain elevated privileges, fetch and run unsigned software, or crash the router. After gaining control, the attacker can modify configuration, add or change administrative access, alter VPN/firewall/DNS/routing behavior, stage persistence through unauthorized firmware or scripts, monitor traffic metadata, proxy traffic through the device, or use the router as a foothold for further attacks against internal systems. Failed exploitation attempts may result in service instability or denial of service.

How to fix it

Upgrade affected Cisco RV340, RV340W, RV345, and RV345P devices to a Cisco firmware release that includes fixes for CVE-2022-20707 and the associated advisory vulnerabilities. No exact fixed versions were provided in the input, so administrators should verify the current Cisco advisory for the device model and install the latest available maintained firmware. If a device is end-of-life or no fixed firmware is available, replace it or remove it from internet-facing use. Until upgrades or replacement are complete, restrict management access to trusted administrative networks or VPN only, disable WAN-side management, block unnecessary inbound access to router services, enforce strong unique administrator credentials, review all local accounts and VPN users, enable remote logging where possible, and back up known-good configuration before remediation. If compromise is suspected, reimage or factory-reset the router, install fixed firmware from Cisco, rotate all administrative, VPN, and shared secrets, and manually rebuild configuration rather than restoring an untrusted backup.

How to confirm the fix worked

Confirm the router model and firmware version through the administrative interface, CLI, device inventory, or authenticated vulnerability scanning, then compare it against Cisco’s fixed firmware guidance for RV340, RV340W, RV345, and RV345P devices. Validate that WAN-side web management and other unnecessary exposed services are disabled or restricted to trusted source addresses. Run an external scan from an untrusted network to verify that management interfaces are not publicly reachable unless explicitly required and protected. Review configuration for unexpected administrator accounts, VPN users, port forwards, DNS settings, static routes, firewall rule changes, remote logging changes, and unauthorized firmware or package references. After patching, perform a controlled rescan with a reputable vulnerability scanner or Cisco-aware detection plugin to verify the issue no longer reports as vulnerable.

Typical attack path

1. Scan for internet-exposed Cisco Small Business RV340/RV340W/RV345/RV345P routers and management services.
2. Fingerprint firmware or management interface behavior to identify likely vulnerable devices.
3. Send crafted unauthenticated requests to the affected router service or web management interface.
4. Trigger authentication bypass, command execution, memory corruption, unsigned software execution, privilege escalation, or denial-of-service behavior depending on the reachable vulnerable component.
5. Establish control by changing configuration, creating or modifying administrative access, uploading or running unauthorized code, or altering firmware/runtime behavior.
6. Use the compromised router to intercept, redirect, proxy, or disrupt network traffic and to pivot toward internal network resources.
7. Attempt to hide activity by clearing logs, disabling remote logging, changing management access rules, or blending with normal administrative traffic.

How to detect it

Investigate both router-local logs and centralized network telemetry because compromised edge routers may have limited forensic retention. Review Cisco RV administrative logs, VPN logs, web management access logs, syslog, firewall events, DHCP/DNS changes, configuration change history, firmware upgrade history, crash/reboot records, and NetFlow or firewall telemetry involving the router’s management and WAN interfaces. Look for unauthenticated or failed management requests immediately followed by reboots, configuration changes, new administrator or VPN accounts, firmware upload activity, changes to DNS servers, static routes, NAT/port-forwarding rules, remote management settings, or disabled logging. Search for management logins from unfamiliar external IP addresses, repeated scanning of router web endpoints, abnormal outbound connections initiated by the router, and traffic from the router to infrastructure not normally used for Cisco updates or administration. If exploitation is suspected, preserve current configuration and logs before factory reset, compare against a known-good backup, and rotate all credentials and shared secrets associated with the device. No reliable CVE-specific file path, process name, registry key, or request string is provided in the available input, so detection should focus on behavioral evidence of edge-device compromise rather than a single signature.

What your security team should do

• Prioritize identification of all Cisco RV340, RV340W, RV345, and RV345P routers, especially internet-facing devices or devices terminating VPN connectivity.
• Upgrade affected routers to the latest Cisco-fixed firmware immediately; replace devices that are unsupported or cannot be remediated.
• Disable WAN-side management and restrict administrative access to trusted networks only.
• Treat unpatched exposed devices as potentially compromised because public exploit maturity is weaponized and EPSS is high.
• Review router configurations for unauthorized accounts, VPN changes, DNS/routing manipulation, firewall rule changes, port forwards, and disabled logging.
• Rotate administrator passwords, VPN credentials, pre-shared keys, API tokens, and any secrets that may have traversed or been stored on the router if compromise cannot be ruled out.
• Enable remote syslog or centralized logging for edge routers so future exploitation attempts and configuration changes are retained off-device.
• Monitor for unusual outbound connections from router management IPs, unexpected reboots, crashes, firmware changes, and administrative logins from unfamiliar source addresses.