EXPOSURES › CVE-2022-20699
CVE-2022-20699
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco Small Business RV routers suffered a stack-based buffer overflow allowing remote code execution and privilege escalation.
A stack-based buffer overflow in Cisco Small Business RV160, RV260, RV340, and RV345 routers allowed attackers to execute arbitrary code, elevate privileges, and bypass authentication. DIB organizations must ensure these devices are patched or replaced, as they are actively exploited in the wild and represent a significant supply-chain and unpatched risk.
Shame score — The vulnerability was actively exploited in the wild (KEV) and allowed full remote code execution and privilege escalation, indicating a severe lapse in the security development lifecycle and patch management.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS)."
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |