EXPOSURES › CVE-2022-20708
CVE-2022-20708
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco Small Business RV Series routers suffered a stack-based buffer overflow allowing arbitrary code execution and privilege escalation.
The vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 routers allowed attackers to execute arbitrary code, elevate privileges, and bypass authentication. DIB organizations must ensure these devices are patched or replaced, as unpatched instances remain actively exploited in the wild. This failure highlights the risk of shipping hardware with known, unpatched RCE flaws that attackers can leverage for initial access.
Shame score — Cisco shipped routers with a critical RCE vulnerability that remained unpatched long enough to be actively exploited in the wild, demonstrating a failure in their security development lifecycle and patch management.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS)."
"This week’s roundup covers a maximum-severity Cisco ISE zero-day under active exploitation, an actively exploited Android modem flaw on Pixel devices, a browser-extension attack that hijacks AI agents across five browsers, and researchers using Claude Opus 5 to"
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |