PT-2022-2297 · Cisco · Rv345+4
Q. Kaiser
·
Published
2022-02-02
·
Updated
2025-03-13
·
CVE-2022-20708
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business RV Series Routers versions prior to the fixed version
Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (affected versions not specified)
Description
The issue allows an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, and cause denial of service (DoS). This is due to multiple vulnerabilities in the Cisco Small Business RV Series Routers, including a stack-based buffer overflow vulnerability and a command injection vulnerability in the update-clients command. The vulnerability can be exploited by sending a specially crafted request, allowing a remote attacker to execute arbitrary commands.
Recommendations
For Cisco Small Business RV Series Routers, update to a version that contains a fix for this issue.
For Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers, consider disabling the
update-clients command as a temporary workaround until a patch is available.
Restrict access to the vulnerable web interface to minimize the risk of exploitation.
Avoid using unsigned software and ensure that all software is properly validated before execution.Fix
DoS
OS Command Injection
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Small Business Rv Series Routers
Rv160
Rv260
Rv340
Rv345