CVE-2022-20699: Cisco Small Business RV Series Routers Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8, KEV listing, and high EPSS probability makes this an urgent patching priority.

What it is

Cisco Small Business RV160, RV260, RV340 and RV345 series routers contain a stack-based buffer overflow (CWE-121) that can be triggered remotely without authentication. Successful exploitation allows arbitrary code execution, privilege elevation, command execution, authentication bypass, unsigned software execution, or denial of service. The flaw is critical because it is network-reachable, requires no credentials or user interaction, and is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An unauthenticated remote attacker can execute arbitrary code or commands on the affected router, elevate privileges, bypass authentication and authorization, or cause a denial of service. This gives full control of the device, which typically sits at the network edge.

Attack surface

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the flaw is reachable over the network with low complexity, no authentication, and no user interaction. Public exploit material references the SSL VPN service on the RV340, but the record does not specify the exact vulnerable endpoint for every model.

Exploitation

CVE-2022-20699 is in CISA's KEV catalog with a due date of 2022-03-17, and EPSS shows a 30-day probability of 0.72458 (99.41st percentile). Public exploit code is referenced via Packet Storm and ZDI, so active exploitation is expected.

What to do

• Apply the Cisco vendor updates referenced in the Cisco Security Advisory cisco-sa-smb-mult-vuln-KA9PK6D as soon as possible.
• If patching cannot be completed immediately, disable or restrict remote management and SSL VPN interfaces to trusted networks only.
• Replace end-of-support RV160/RV260/RV340/RV345 units where no fixed firmware is available.
• Monitor CISA KEV guidance and confirm remediation by the 2022-03-17 due date.
• Segment affected routers from internal networks to limit lateral movement if compromised.

Detection

• Monitor router logs for crashes, unexpected reboots, or service restarts that may indicate exploitation attempts.
• Inspect network traffic to SSL VPN and remote management ports for malformed or oversized requests.
• Alert on unexpected outbound connections or new processes on the router that suggest code execution.
• Review authentication logs for bypass patterns or anomalous administrative access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.