CVE-2023-20073

What it actually does

CVE-2023-20073 is an unauthenticated arbitrary file upload vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN routers. Because the interface does not properly enforce authorization on file upload operations, a remote attacker can send crafted HTTP requests that write attacker-controlled files to the device. Depending on upload location, file type handling, and device configuration, this can lead to device compromise, persistence, configuration tampering, credential exposure, traffic interception, denial of service, or use of the router as a foothold into internal networks. The CVSS 9.8 score reflects network-reachable exploitation with no authentication or user interaction required, and the high EPSS score plus weaponized exploit maturity indicate substantial real-world exploitation likelihood.

Why it matters to the business

Affected routers often sit at network edges and may terminate VPNs, route business traffic, and enforce connectivity between sites. Compromise can disrupt internet or branch connectivity, expose sensitive traffic, enable attackers to pivot into internal systems, alter routing or firewall behavior, and create persistent unauthorized access. Because these devices are perimeter-facing and exploitation is unauthenticated with weaponized activity reported, organizations using affected Cisco RV340-series devices should treat internet-exposed management interfaces as high-risk even though this CVE is not currently listed in CISA KEV and has not been specifically flagged for ransomware use.

How an attack unfolds

An attacker first identifies Cisco RV340, RV340W, RV345, or RV345P devices with the web management interface reachable over the network, commonly by scanning internet-facing HTTPS/HTTP services and fingerprinting router login or management pages. The attacker then sends a specially crafted HTTP file upload request to the vulnerable management endpoint. Because authorization checks are insufficient, the device accepts the upload even though the attacker is not authenticated. The uploaded file may be used to modify device behavior, stage additional tooling, overwrite or add configuration artifacts, enable persistence, or support follow-on exploitation. Once a file is placed successfully, the attacker may attempt to trigger it, access it through the web interface, abuse it to gain deeper control of the router, harvest configuration and VPN information, or use the device as a pivot point into connected networks.

How to fix it

Upgrade affected Cisco RV340, RV340W, RV345, and RV345P firmware to a Cisco release that addresses CVE-2023-20073, following Cisco’s security advisory and platform-specific upgrade path. If no fixed version is available for a deployed model or support has ended, replace the device or remove it from service. As immediate mitigation, disable remote web-based management from the internet, restrict management access to a dedicated administrative network or VPN, apply source-IP allowlisting, block management ports at upstream firewalls, and ensure strong administrative credentials and MFA where supported. Review device configuration for unauthorized changes before and after upgrade, and consider factory reset/rebuild from trusted configuration if compromise is suspected.

How to confirm the fix worked

Confirm the exact device model and firmware version from the router administration interface, CLI, asset inventory, or authenticated configuration backup, then compare it with Cisco’s advisory for the fixed or unaffected release. Verify that the web-based management interface is not reachable from the public internet or untrusted networks by performing external port scans for HTTP/HTTPS management services. After upgrading or replacing the device, re-run exposure checks and, where permitted, use a safe authenticated vulnerability scanner or vendor-specific check to confirm the device is no longer reported vulnerable. Validate mitigation by confirming access controls restrict management endpoints to approved administrative sources only.

Typical attack path

1. Scan for Cisco RV340, RV340W, RV345, or RV345P web-based management interfaces exposed to the internet or reachable from an untrusted network.
2. Fingerprint the device model and firmware family from HTTP headers, login pages, TLS certificates, page titles, static assets, or response behavior.
3. Send a crafted unauthenticated HTTP request to the vulnerable file upload functionality.
4. Upload attacker-controlled content to the router filesystem.
5. Attempt to access, execute, or otherwise leverage the uploaded file depending on where it was written and how the device handles uploaded content.
6. Modify device configuration, establish persistence, collect configuration/VPN data, disrupt routing, or pivot toward internal networks.

How to detect it

Look for evidence of unauthenticated HTTP POST or multipart file upload requests to the router management interface, especially from external IP addresses or sources that do not normally administer network devices. Relevant sources include router system logs, web management access logs if available, upstream firewall logs, reverse proxy logs if management is proxied, NetFlow/IPFIX, IDS/IPS alerts, configuration change logs, and periodic configuration backups. Investigate unusual requests to upload-related endpoints, unexpected HTTP 200/302 responses following unauthenticated POSTs, new or modified files in web-accessible or configuration-related directories, unexplained configuration changes, new administrative users, changed VPN/firewall/NAT settings, and anomalous outbound connections from the router after the suspected upload. Because embedded router logging may be limited or overwritten, correlate external network telemetry with device configuration diffs and any centralized syslog records. Treat scans followed by successful POST activity to management ports as suspicious, especially where the source is not an approved administrator.

• HTTP POST requests to Cisco RV340/RV340W/RV345/RV345P web management interfaces from non-administrative source IPs
• multipart/form-data requests to router management ports 80 or 443
• Content-Disposition: form-data; name="file"
• Unexpected HTTP 200 responses to unauthenticated file upload requests
• Unexpected HTTP 302 responses following unauthenticated POST requests to the router management interface
• Cisco RV340
• Cisco RV340W
• Cisco RV345
• Cisco RV345P
• User-Agent strings associated with vulnerability scanners followed by POST requests to management endpoints
• New or modified router configuration files after suspicious web management POST activity
• Unexpected new administrative users on the router
• Unauthorized changes to VPN configuration on the router
• Unauthorized changes to firewall rules on the router
• Unauthorized changes to NAT or port-forwarding rules on the router
• Outbound connections initiated by the router to unfamiliar external IP addresses after management-interface upload activity

What your security team should do

• Immediately inventory Cisco RV340, RV340W, RV345, and RV345P routers and identify any internet-exposed web management interfaces.
• Prioritize patching, replacement, or isolation of exposed devices because exploitation is unauthenticated, low-complexity, high-impact, and weaponized with a high EPSS score.
• Disable internet-facing remote management and restrict router administration to trusted networks or VPN-only access.
• Review router configurations, user accounts, VPN settings, firewall/NAT rules, startup scripts, and file storage areas for unauthorized changes or unfamiliar artifacts.
• Collect and preserve device logs, configuration backups, and network telemetry before rebooting or rebuilding if compromise is suspected.
• Rotate administrative credentials and VPN/shared secrets associated with affected routers if unauthorized file upload or configuration access is suspected.
• Monitor for anomalous outbound connections, unexpected management logins, unusual file upload requests, configuration changes, and traffic patterns indicating the router is being used as a pivot or proxy.
• If fixed firmware is unavailable or the model is end-of-life, replace the device rather than relying solely on compensating controls.