{"id":"CVE-2022-20701","kind":"vulnerability","aliases":["CVE-2022-20701"],"related":[],"title":"Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","description":"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.","summary":"CVE-2022-20701 is in Cisco's Feb 2022 multi-CVE advisory for RV Series routers. Per Cisco it affects only RV340, RV340W, RV345 and RV345P, and lets an attacker gain root through the web-based management interface because of insufficient authorization. Cisco rates it Critical (CVSS 9.0, local vector). CISA KEV lists it as exploited and labels it a stack-based buffer overflow (CWE-121). Cisco says no workarounds exist; update the firmware.","severity":"critical","cvss":10.0,"epss":0.09747,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Cisco RV340/RV340W/RV345/RV345P routers firmware","fixed":["1.0.03.26"],"affected":"<= 1.0.03.24","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","infrastructure","rv160","rv260","rv340","rv345","small-business-routers","web-management"],"not_affected_if":["firmware-1.0.03.26-or-later","rv160-rv260-only","unknown"],"how_to_check":"In the router web UI (Firmware/System Summary), check firmware version on RV340/RV345 family; 1.0.03.24 or earlier is vulnerable. RV160/RV260 are not affected by this CVE per Cisco.","fix":"Upgrade RV340/RV340W/RV345/RV345P firmware to 1.0.03.26 or later. No workaround. Restrict web management to trusted internal networks as general hardening (not a Cisco-stated mitigation).","status":"open","published_at":"2022-02-10T18:15:09+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:24:25+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:24:25Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per Cisco's vendor instructions; the specific fixed firmware version is unknown from the sources.","reach":"unknown","impact":"high","summary":"A stack-based buffer overflow in Cisco Small Business RV160, RV260, RV340 and RV345 routers lets an attacker run arbitrary code on the device. The flaw is listed as actively exploited in the wild by CISA.","category":"infrastructure","who_cares":["cisco","small-business-routers","rv160","rv260","rv340","rv345"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the router and can take over the device.","analyst_note":"Find Cisco's advisory for CVE-2022-20701 for affected and fixed firmware versions, and whether the attack needs the web management interface exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2948,"output_tokens":366,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find Cisco's advisory for CVE-2022-20701 for affected and fixed firmware versions, and whether the attack needs the web management interface exposed.","search":"'-121':125B '-2022':24A,27A,58B '-20701':25A,28A,59B '2022':65B '9.0':106B 'advisori':69B,192C 'affect':77B 'allow':148C 'and':35A 'arbitrari':158C,163C 'attack':87B,150C 'authent':166C 'author':100B,168C 'base':19A,94B,121B 'buffer':20A,122B 'busi':3A,13A,52B,139C 'business':31A 'bypass':165C 'caus':175C 'cisa':109B 'cisco':1A,11A,29A,39A,43B,62B,75B,101B,126B,137C 'code':159C 'command':164C 'could':147C 'critic':104B 'cve':23A,26A,57B,68B 'cvss':105B 'cwe':124B 'denial':176C 'detail':188C 'dos':179C 'elev':160C 'execut':157C,162C 'exist':130B 'exploit':44B,114B 'feb':64B 'fetch':170C 'firmwar':133B 'firmware':42A 'follow':156C 'gain':88B 'inform':182C 'infrastructur':45B 'insuffici':99B 'interfac':96B 'kev':110B 'label':116B 'let':85B 'list':111B 'local':107B 'manag':56B,95B 'multi':67B 'multi-cv':66B 'multipl':134C 'overflow':21A,123B 'per':74B 'privileg':161C 'protect':169C 'rate':102B 'root':89B 'router':10A,16A,53B,73B,146C 'routers':38A,41A 'run':172C 'rv':14A,71B 'rv160':4A,32A,46B,140C 'rv260':5A,33A,47B,141C 'rv340':6A,34A,48B,79B,142C 'rv340/rv340w/rv345/rv345p':40A 'rv340w':80B 'rv345':8A,36A,49B,81B,144C 'rv345p':83B 'say':127B 'section':189C 'see':186C 'seri':9A,15A,72B,145C 'series':37A 'servic':178C 'small':2A,12A,30A,51B,138C 'small-business-rout':50B 'softwar':174C 'stack':18A,120B 'stack-bas':17A,119B 'unsign':173C 'updat':131B 'vector':108B 'vulner':22A,135C,185C 'web':55B,93B 'web-bas':92B 'web-manag':54B 'workaround':129B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-02-10T18:15:09+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-20701","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20701","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2022-20701","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-20701","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-20701:74","url":null,"severity":null,"published_at":"2026-10-23T21:25:59+00:00","modified_at":"2026-10-23T21:25:59+00:00","first_seen_at":"2026-10-23T21:25:59+00:00","fetched_at":"2026-10-23T21:25:59+00:00","note":"Read Cisco advisory cisco-sa-smb-mult-vuln-KA9PK6D (Feb 2022): 20701 affects only RV340/RV340W/RV345/RV345P; fixed 1.0.03.26. Advisory text calls it a web-management privilege escalation (CVSS 9.0, AV:L), while KEV/CWE-121 says stack buffer overflow; descriptions differ. Cisco confirms PoC exists for several of the advisory's CVEs, not tied to this one. No workaround. In-the-wild exploitation from CISA KEV only."},{"source":"nvd","external_id":"CVE-2022-20701","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20701","severity":null,"published_at":"2022-02-10T18:15:09+00:00","modified_at":"2026-06-17T04:24:53+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":1014,"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-smb-mult-vuln-KA9PK6D.html","title":"Cisco Small Business RV Series Routers Vulnerabilities (cisco-sa-smb-mult-vuln-KA9PK6D)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1015,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f=vendor_project%3A1043&f=vendor_project%3A1151&f=vendor_project%3A1174&f=vendor_project%3A1271&page=6","title":"CISA KEV entry CVE-2022-20701","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1016,"url":"https://cert.cyber.gouv.fr/avis/CERTFR-2022-AVI-107","title":"CERT-FR CERTFR-2022-AVI-107","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}