peter bassill · operator
$ cve CVE-2022-20703 JSON

CVE-2022-20703 KEV

10.0
CRITICAL · CVSS 3.1 · EPSS 9.2% (pctl 95)

Patch first

On CISA KEV — known exploited in the wild, due 2022-03-17.

Description

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Scoring

CVSS10.0 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS9.2% — more likely to be exploited than 95% of all CVEs
WeaknessCWE-121
On CISA KEVyes — remediate by 2022-03-17
Public exploitnone known
Published2022-02-10
Last modified2026-06-17

CISA KEV

NameCisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
Added2022-03-03
Due2022-03-17
Vendor / productCisco / Small Business RV160, RV260, RV340, and RV345 Series Routers
Ransomware usenone reported

Affected (18)

VendorProduct
ciscorv160
ciscorv160 firmware
ciscorv160w
ciscorv160w firmware
ciscorv260
ciscorv260 firmware
ciscorv260p
ciscorv260p firmware
ciscorv260w
ciscorv260w firmware
ciscorv340
ciscorv340 firmware
ciscorv340w
ciscorv340w firmware
ciscorv345
ciscorv345 firmware
ciscorv345p
ciscorv345p firmware

References

→ the Explorer  ·  watch your stack  ·  NVD