PT-2022-2302 · Cisco · Rv345+8
Stephen Fewer
·
Published
2022-02-02
·
Updated
2025-03-13
·
CVE-2022-20700
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business RV Series Routers versions RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, RV345P
Description
The issue is related to a stack-based buffer overflow vulnerability and insufficient authorization in the web interface of the affected routers. This could allow a remote attacker to elevate privileges to the level of root, execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS).
Recommendations
For RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, RV345P, update the firmware to a version that addresses the vulnerabilities.
As a temporary workaround, consider restricting access to the web interface of the affected routers until a patch is available.
Restrict access to the vulnerable
web interface to minimize the risk of exploitation.
Avoid using unsigned software on the affected routers until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Improper Authorization
Memory Corruption
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Rv160
Rv160W
Rv260
Rv260P
Rv260W
Rv340
Rv340W
Rv345
Rv345P