CVE-2022-20708

What it actually does

This vulnerability affects Cisco Small Business RV340, RV340W, RV345, and RV345P router firmware and can allow a low-privileged attacker with adjacent-network access to inject or trigger arbitrary commands in the router management/control plane. Successful exploitation can result in execution of attacker-controlled code or commands, privilege escalation, authentication or authorization bypass, installation of unsigned software, configuration compromise, and denial of service. Because these devices commonly sit at network boundaries, compromise can give an attacker a foothold for traffic interception, persistence, and lateral movement.

Why it matters to the business

A compromised branch or small-business router can disrupt internet/VPN connectivity, expose internal network traffic, weaken perimeter defenses, and provide an attacker with a persistent entry point into the organization. This issue is listed in CISA KEV with active exploitation in the wild and had a federal remediation due date of 2022-03-17, so any remaining exposure should be treated as urgent even though the vulnerability is older. No ransomware use is identified in the provided data, but edge-device compromise is commonly used for espionage, botnets, proxying, credential theft, and follow-on intrusion activity.

How an attack unfolds

An attacker first identifies an affected Cisco Small Business RV-series router that is reachable from an adjacent network or exposed management segment. If the vulnerable management or service interface is accessible and the attacker has or can obtain a low-privileged session, they send crafted input that is mishandled by the firmware. The router processes that input in a privileged context, allowing injected commands or code execution. The attacker can then modify configuration, create or abuse accounts, fetch and execute unsigned payloads, disable services, pivot through VPN or LAN routing paths, or crash the device to cause denial of service. Because this class of device often has limited endpoint telemetry, exploitation may be followed by log clearing, configuration changes, or deployment of lightweight Linux/MIPS/ARM malware in temporary filesystem locations.

How to fix it

Upgrade affected Cisco Small Business RV340, RV340W, RV345, and RV345P devices to a Cisco firmware release that addresses CVE-2022-20708 and the associated advisory issues. If a fixed release is not available for a specific model or the device is end-of-life, replace it with a supported platform. Restrict router administration to a dedicated management network or VPN, disable WAN-side administration, remove unnecessary services, enforce strong unique administrator credentials, and review all local accounts and VPN users. Where immediate upgrade or replacement is not possible, place compensating controls in front of the device, limit access by source IP, monitor management-plane traffic closely, and plan expedited retirement.

How to confirm the fix worked

Inventory all Cisco Small Business RV340, RV340W, RV345, and RV345P devices and confirm the running firmware version from the device management interface, CLI, or centralized asset inventory. Compare installed firmware against Cisco’s security advisory and the organization’s approved fixed baseline. Verify that remote administration is disabled from untrusted networks and that management access is limited to authorized sources only. After remediation, perform an authenticated configuration review to confirm no unexpected administrator accounts, VPN users, startup scripts, scheduled tasks, DNS changes, port forwards, or unknown firmware/images remain. Where feasible, run a non-destructive vulnerability scan or configuration compliance check to confirm the device no longer reports exposure.

Typical attack path

1. Discover Cisco Small Business RV340/RV340W/RV345/RV345P routers through network scanning, exposed management services, VPN portals, or adjacent-network reconnaissance.
2. Confirm firmware family and vulnerable management/service exposure.
3. Obtain or abuse a low-privileged account, session, or reachable vulnerable interface as required by the attack path.
4. Send crafted requests or inputs that trigger command injection or related firmware execution flaws.
5. Execute commands in the router operating environment, often to download tooling, alter configuration, or establish persistence.
6. Use the compromised router to intercept traffic, proxy attacks, pivot into internal networks, maintain VPN/perimeter access, or cause service disruption.

How to detect it

Look for evidence of exploitation in router system logs, web administration logs, AAA/RADIUS/TACACS records, VPN logs, firewall logs, NetFlow, DNS logs, and upstream proxy records. Focus on unexpected administrative logins, failed or successful logins from unusual source addresses, configuration changes outside maintenance windows, firmware/image changes, new local users, altered VPN settings, DNS server changes, new port forwarding rules, unexplained reboots, crashes, or DoS symptoms. Review outbound traffic initiated by the router itself, especially connections to file-hosting locations or unusual external IPs using HTTP, HTTPS, TFTP, FTP, Telnet, SSH, or raw TCP. Search management-plane logs for shell metacharacters or encoded command-injection patterns in requests, including semicolons, pipes, backticks, command substitution, and references to common download or execution tools. Because edge routers often retain limited logs, supplement device telemetry with upstream firewall, DNS, DHCP, NetFlow, and authentication logs. For suspected compromise, acquire the running configuration, account list, routing/NAT/VPN settings, firmware version, and available logs before remediation actions overwrite volatile evidence.

• ;wget
• ; curl
• |wget
• | curl
• `wget
• `curl
• $(wget
• $(curl
• %3Bwget
• %3Bcurl
• %7Cwget
• %7Ccurl
• tftp -g
• ftpget
• chmod +x /tmp
• chmod 777 /tmp
• /tmp/.
• /var/tmp/
• busybox wget
• busybox tftp
• /bin/sh -c
• sh -c wget
• sh -c curl
• nc -e
• /etc/passwd
• /etc/shadow
• admin login failed
• configuration changed
• firmware upgrade
• unexpected reboot

What your security team should do

• Treat any internet-exposed or broadly reachable affected router as high priority because this vulnerability is in CISA KEV and has been exploited in the wild.
• Immediately identify all Cisco Small Business RV340/RV340W/RV345/RV345P devices and verify firmware status.
• Upgrade to a Cisco-fixed firmware release or replace unsupported/end-of-life devices with supported hardware.
• Disable WAN-facing management and restrict administrative access to a trusted management network or VPN with source-IP controls.
• Rotate administrator, VPN, and shared local credentials after patching, especially if exposure existed before remediation.
• Review router configurations for unauthorized users, altered DNS settings, new port forwards, modified VPN settings, suspicious startup entries, or unexpected firmware/software.
• Collect and preserve device logs before rebooting or factory-resetting suspected compromised routers.
• Monitor for outbound connections from routers to unusual external IPs, especially downloads via HTTP, HTTPS, TFTP, FTP, or connections to known botnet/proxy infrastructure.
• If compromise is suspected, rebuild from known-good firmware, restore only reviewed configuration, and investigate downstream systems for lateral movement.