EXPOSURES › CVE-2022-20703
CVE-2022-20703
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco Small Business RV routers suffered a stack-based buffer overflow allowing arbitrary code execution and privilege escalation.
A stack-based buffer overflow in Cisco Small Business RV160, RV260, RV340, and RV345 routers allowed attackers to execute arbitrary code, elevate privileges, and bypass authentication. DIB organizations must ensure these devices are patched or replaced, as they represent a high-risk entry point for network compromise and violate CMMC/NIST 800-171 requirements for patch management and system hardening.
Shame score — The vulnerability was actively exploited in the wild (KEV) and allowed full system compromise, indicating a severe lapse in Cisco's security development lifecycle and patch management for widely deployed small business hardware.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |