CVE-2023-20118
Cisco Small Business RV Series Routers Command Injection Vulnerability
Description
CVE-2023-20118 is a medium-severity command injection vulnerability in the web-based management interface of Cisco Small Business RV Series Routers, including models RV016, RV042, RV042G, RV082, RV320, and RV325. An authenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the affected device by sending specially crafted HTTP packets. With a CVSS v3.1 base score of 6.5, the vulnerability is due to improper validation of user input within incoming HTTP requests. CISA has added CVE-2023-20118 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 24, 2025, and the EPSS score of 3.36% at the 87th percentile indicates elevated exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | rv016 firmware | All versions |
| cisco | rv042 firmware | All versions |
| cisco | rv042g firmware | All versions |
| cisco | rv082 firmware | All versions |
| cisco | rv320 firmware | All versions |
| cisco | rv325 firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20118(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements Used in a Command (Command Injection)
CVE-2023-20118 is a command injection vulnerability where user input from HTTP packets is improperly validated before being passed to system-level commands on the router. Command injection occurs when an application constructs operating system commands using externally supplied input without adequate sanitization, allowing attackers to inject additional commands that are executed by the underlying operating system. In the Cisco Small Business RV Series routers, the web management interface fails to properly neutralize special characters in HTTP request parameters, enabling authenticated attackers to inject and execute arbitrary shell commands on the router's Linux-based operating system.
Learn more: CWE-77 — Improper Neutralization of Special Elements Used in a Command (Command Injection)
Impact Analysis
CVE-2023-20118 poses a significant threat to organizations relying on Cisco Small Business RV Series Routers for network connectivity. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L), though it requires high privileges (PR:H) — specifically administrative credentials for the router's web interface — and no user interaction (UI:N). Confidentiality (High): Command execution on the router grants access to the device's configuration, including VPN credentials, firewall rules, routing tables, SNMP community strings, and potentially captured network traffic. For VPN concentrators like the RV320 and RV325, this includes credentials for all VPN tunnels. Integrity (High): The attacker can modify router configurations, alter firewall rules to permit malicious traffic, redirect DNS queries, inject routes to intercept traffic, and install persistent backdoors on the device. Availability: While the CVSS vector rates availability impact as none (A:N), practical exploitation can still disrupt network services through configuration changes. The affected router models — RV016, RV042, RV042G, RV082, RV320, and RV325 — are widely deployed in small and medium-sized businesses, often serving as the primary network gateway. The requirement for administrative credentials (PR:H) somewhat limits the attack surface, but default credentials, credential reuse, and prior compromise through other vulnerabilities frequently provide attackers with the necessary access.
Exploit Maturity
CVE-2023-20118 demonstrates confirmed active exploitation in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, mandating remediation by March 24, 2025. The EPSS score of 3.36% at the 87th percentile indicates exploitation activity above the majority of tracked vulnerabilities. While the ransomware association is currently listed as unknown, Cisco Small Business routers are frequently targeted by botnets and advanced persistent threat groups for use as network pivoting points and traffic interception platforms. Cisco has published a security advisory with mitigation guidance, noting that these router models have reached end-of-life and will not receive firmware patches. This makes the vulnerability particularly dangerous, as there is no vendor-supplied fix available.
Remediation
-
Replace end-of-life Cisco RV Series routers. Cisco has confirmed that the affected router models (RV016, RV042, RV042G, RV082, RV320, RV325) have reached end-of-life and will not receive firmware updates to address CVE-2023-20118. The recommended action is to migrate to currently supported Cisco router models that receive ongoing security updates.
-
Disable remote management immediately. If replacement is not immediately possible, disable the remote management interface on affected routers to prevent exploitation from external networks. Ensure the web-based management interface is only accessible from trusted internal network segments.
-
Implement strong authentication controls. Change default administrative credentials, enforce strong unique passwords, and limit the number of administrative accounts. Since exploitation requires high-privilege access (PR:H), protecting administrative credentials significantly reduces the attack surface.
-
Deploy network-level access controls. Place affected routers behind additional firewall or access control layers that restrict management interface access to specific trusted IP addresses. Implement VPN requirements for any remote administrative access.
-
Monitor for exploitation indicators. Review router logs for unusual administrative login patterns, unexpected configuration changes, and abnormal command execution. Deploy network monitoring to detect suspicious traffic patterns associated with compromised edge devices, including unexpected outbound connections and traffic redirection.
Technical Details
CVE-2023-20118 is a command injection vulnerability in the web-based management interface of Cisco Small Business RV Series Routers. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N indicates that the vulnerability is remotely exploitable with low complexity but requires high-privilege (administrative) authentication, achieving high confidentiality and integrity impact without direct availability impact. The vulnerability exists in the HTTP request processing logic of the router's web management interface. When the router processes incoming HTTP packets from an authenticated administrator, certain input parameters are incorporated into system-level commands without adequate validation or sanitization of special characters (such as semicolons, pipes, backticks, and command substitution sequences). An attacker with valid administrative credentials can craft HTTP requests containing command injection payloads that break out of the intended command context and execute arbitrary shell commands on the router's underlying Linux operating system. The commands execute with root-level privileges, as the web server process typically runs with elevated permissions on these embedded devices. The affected models span Cisco's Small Business RV line: RV016 (multi-WAN VPN router), RV042 and RV042G (dual-WAN VPN routers), RV082 (dual-WAN VPN router), and RV320/RV325 (dual Gigabit WAN VPN routers). All these models share a common firmware codebase with the vulnerable web management interface and have reached end-of-life status without receiving a fix.
Frequently Asked Questions
Is CVE-2023-20118 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2023-20118 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 24, 2025. The vulnerability is particularly attractive to attackers because the affected routers are end-of-life and will not receive firmware patches from Cisco.
What Cisco router models are affected by CVE-2023-20118?
CVE-2023-20118 affects Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325. All firmware versions for these models are affected, and Cisco has confirmed no patches will be released as these products have reached end-of-life.
Is there a patch available for CVE-2023-20118?
No. Cisco has confirmed that the affected RV Series router models have reached end-of-life and will not receive firmware updates. The recommended mitigation is to migrate to a currently supported Cisco router model. In the interim, disabling remote management and restricting management interface access can reduce the risk.
Does CVE-2023-20118 require authentication to exploit?
Yes. CVE-2023-20118 requires high-privilege (administrative) authentication to exploit. An attacker needs valid administrative credentials for the router's web management interface. However, default credentials, credential reuse, and brute force attacks can often provide the necessary access, especially on devices with poor password hygiene.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.