CVE-2022-20699
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
Description
CVE-2022-20699 is a critical-severity stack-based buffer overflow vulnerability affecting Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 89.9% (99.6th percentile), this vulnerability has a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | rv340 firmware | <= 1.0.03.24 |
| cisco | rv340w firmware | <= 1.0.03.24 |
| cisco | rv345 firmware | <= 1.0.03.24 |
| cisco | rv345p firmware | <= 1.0.03.24 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D(Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-22-414/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20699(US Government Resource)
Weakness Type
CWE-121: Stack-based Buffer Overflow
Stack-based Buffer Overflow is a variant of buffer overflow that occurs when a buffer allocated on the stack is overwritten with data larger than its allocated size. The stack stores local variables, function parameters, and return addresses. Additionally, this vulnerability involves CWE-1284 (Improper Validation of Specified Quantity in Input), which improper validation of specified quantity in input occurs when a product receives input specifying a quantity (size, length, frequency, price, rate, number of operations, time, etc.) but fails to validate or incorrectly validates that the quantity has required properties.
Learn more: CWE-121 — Stack-based Buffer Overflow
Impact Analysis
CVE-2022-20699 carries a CVSS 3.1 score of 10 (CRITICAL), indicating a maximum-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication. Successful exploitation can severely compromise data confidentiality, and allow unauthorized modification of data and systems, and cause complete service disruption. The scope is changed, meaning exploitation can impact resources beyond the vulnerable component itself, amplifying the overall damage. Organizations running affected Small Business RV160, RV260, RV340, and RV345 Series Routers deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2022-20699 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 89.9% (99.6th percentile) reflects an exceptionally high probability of exploitation. Public exploit code is available, which lowers the barrier for attackers and increases the urgency of remediation. Federal agencies were required to remediate this vulnerability by 2022-03-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (cisco rv340 firmware <= 1.0.03.24; cisco rv340w firmware <= 1.0.03.24; cisco rv345 firmware <= 1.0.03.24) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2022-20699 affects Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The maximum CVSS score of 10 reflects the combination of easy exploitability and severe impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2022-20699 being actively exploited?
Yes. CVE-2022-20699 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 89.9% (99.6th percentile) further indicates a very high exploitation probability.
What products are affected by CVE-2022-20699?
CVE-2022-20699 affects Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Specifically affected products include: cisco rv340 firmware (<= 1.0.03.24), cisco rv340w firmware (<= 1.0.03.24), cisco rv345 firmware (<= 1.0.03.24), cisco rv345p firmware (<= 1.0.03.24).
How do I fix CVE-2022-20699?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2022-20699?
CVE-2022-20699 has a CVSS 3.1 score of 10 (CRITICAL). This is a critical-severity vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.