CVE-2022-20703
Published on February 10, 2022

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Vendor Advisory NVD

Known Exploited Vulnerability

This Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

The following remediation steps are recommended / required by March 17, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2022-20703 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.5 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Certificate Validation

The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.


Products Associated with CVE-2022-20703

You can be notified by stack.watch whenever vulnerabilities like CVE-2022-20703 are published in these products:

What versions are vulnerable to CVE-2022-20703?

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.