CVE-2023-20118

What it actually does

CVE-2023-20118 is an authenticated command injection vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 routers. The flaw is caused by improper validation of user-supplied input in HTTP requests sent to the administrative interface. An attacker with valid administrative credentials can send crafted requests that cause the router to execute arbitrary operating-system commands with root-level privileges. Successful exploitation can expose configuration data, VPN credentials, routing information, and other sensitive device data, and can allow the attacker to alter device behavior, deploy persistence, pivot through the network, or disrupt connectivity.

Why it matters to the business

Affected Cisco Small Business RV Series routers are end-of-life or otherwise not receiving a security update for this issue, so vulnerable devices cannot be remediated by patching. Because this vulnerability is listed in CISA Known Exploited Vulnerabilities and has active in-the-wild exploitation with a high EPSS score, internet-exposed management interfaces represent urgent risk. Compromise of an edge router can lead to outage, traffic interception, credential theft, unauthorized remote access, VPN compromise, and use of the device as a foothold for further attacks. Organizations subject to CISA KEV guidance were expected to address this vulnerability by 2025-03-24; remaining exposure should be treated as overdue and high priority.

How an attack unfolds

An attacker first obtains valid administrative credentials for the router, commonly through password reuse, default or weak credentials, credential theft, prior compromise, or exposed management services. The attacker then connects to the router’s web-based management interface over the network. After authenticating, the attacker sends a specially crafted HTTP request containing malicious input to a vulnerable management endpoint. Because the router fails to properly validate that input, the payload is interpreted as an operating-system command and runs with root privileges. From that position, the attacker can read configuration files, extract VPN or administrative secrets, modify routing or firewall rules, create or alter accounts where supported, stage scripts or binaries, proxy traffic, or disrupt the device. Since the affected products do not have vendor-provided fixed firmware for this vulnerability, exploitation risk persists until the device is removed, replaced, or the management interface is effectively isolated.

How to fix it

Cisco has stated that it has not released and will not release software updates to address this vulnerability. The primary remediation is to retire and replace affected Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 routers with supported devices. Until replacement is complete, disable WAN or internet access to the web-based management interface, restrict administrative access to a dedicated management network or VPN, enforce strong unique administrative credentials, remove unused admin accounts, limit access with ACLs or firewall rules, and monitor all administrative activity. Do not rely on compensating controls as a permanent fix because the underlying command injection remains present. If compromise is suspected, treat the device as untrusted: preserve logs and configuration for investigation, rotate credentials and VPN keys, review firewall and routing rules, and rebuild or replace the device rather than simply changing passwords.

How to confirm the fix worked

Inventory perimeter and branch routers and confirm whether any Cisco RV016, RV042, RV042G, RV082, RV320, or RV325 devices remain in service. Verify firmware and model information from the device UI, CLI where available, asset management, network scans, or configuration backups. Confirm that no affected device exposes its web-based management interface to the internet or untrusted networks. Validate firewall and ACL rules by scanning from outside the trusted management network for HTTP or HTTPS administrative ports. Confirm that administrative access requires unique credentials and is limited to authorized source addresses. Because no fixed version exists, validation of remediation means confirming device replacement or full removal from production; if a device remains deployed, document the compensating controls and residual risk.

Typical attack path

1. Identify an exposed Cisco Small Business RV016, RV042, RV042G, RV082, RV320, or RV325 router management interface.
2. Obtain or reuse valid administrative credentials for the web-based management interface.
3. Authenticate to the router’s administrative web interface.
4. Send a crafted HTTP request containing command-injection payloads to the vulnerable interface.
5. Execute arbitrary commands as root on the router operating system.
6. Collect configuration, credentials, VPN settings, routing data, or other sensitive information.
7. Modify router configuration, establish persistence where possible, pivot into internal networks, proxy malicious traffic, or disrupt network connectivity.

How to detect it

Review router administrative logs, web management logs if available, syslog exports, firewall logs, VPN logs, and network telemetry for authenticated administrative sessions followed by unusual HTTP requests, configuration changes, or command-like input. Focus on access to the management interface from unexpected external IP addresses, unusual geographies, nonstandard user agents, repeated login attempts followed by successful authentication, and administrative activity outside normal maintenance windows. Look for changes to DNS servers, static routes, firewall or NAT rules, port forwarding, VPN configuration, remote management settings, and new or modified administrator accounts. Network devices with limited logging may not retain enough evidence, so correlate upstream firewall, reverse proxy, NetFlow, IDS, and packet capture data where available. Because exploitation results in root-level command execution, also look for unexplained device reboots, configuration exports, outbound connections from the router to unfamiliar hosts, traffic proxying behavior, or unexpected management-plane connections. If the device was internet-exposed or logs are incomplete, assume possible credential and configuration exposure and rotate secrets during replacement.

• HTTP requests to Cisco RV Series management interfaces containing shell metacharacters such as ;, |, &&, ||, `, $(
• Unexpected successful admin login to the router web management interface
• Administrative access to / from untrusted or internet source IP addresses
• Configuration changes to DNS server settings
• Configuration changes to static routes
• Configuration changes to firewall rules
• Configuration changes to NAT or port forwarding rules
• Configuration changes enabling remote management
• New or modified administrator account on Cisco RV Series router
• Unexpected outbound connections originating from the router management IP
• Unexpected router reboot following web administration activity
• User-Agent strings not normally used for router administration accessing the management interface

What your security team should do

• Immediately identify all Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 routers, prioritizing internet-facing and VPN-edge deployments.
• Replace affected routers with supported hardware because Cisco will not provide a software fix for this vulnerability.
• Disable external access to the web-based management interface and restrict administrative access to trusted management networks only.
• Review administrative accounts, remove unused users, and rotate router administrator passwords, VPN pre-shared keys, certificates, and any credentials stored on or passing through the device.
• Investigate exposed or previously exposed devices for signs of compromise, especially because this vulnerability is in the CISA KEV catalog and has active exploitation reported.
• Review router configuration for unauthorized changes to DNS, static routes, firewall rules, port forwards, VPN settings, and remote management settings.
• If exploitation is suspected, replace or factory-reset the device, restore only known-good configuration, and rotate all secrets that may have been exposed.
• Track CISA KEV deadline status and treat any remaining exposure after 2025-03-24 as overdue remediation risk.