CVE-2022-20700: Cisco Small Business RV Series Routers stack-based buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCritical CVSS 9.8 with no authentication or user interaction required, and confirmed active exploitation per CISA KEV.

What it is

CVE-2022-20700 is a stack-based buffer overflow and out-of-bounds write in Cisco Small Business RV160, RV260, RV340 and RV345 Series Routers. The advisory groups it with other flaws that can lead to arbitrary code execution, privilege elevation, command execution, authentication bypass, unsigned software execution or denial of service. It matters because these are internet-facing edge devices with a critical severity rating and confirmed exploitation in the wild.

Impact

An unauthenticated remote attacker can potentially execute arbitrary code or commands, elevate privileges, bypass authentication and authorization, or cause a denial of service on the affected router. Full compromise of the device would expose the network behind it.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), so the flaw is exploitable over the network without authentication. The record does not specify which service or port is targeted.

Exploitation

CVE-2022-20700 is listed in CISA's Known Exploited Vulnerabilities catalog with a 2022-03-17 remediation due date, indicating active exploitation. EPSS gives a 30-day probability of about 5.7 percent (92.6th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Cisco firmware updates referenced in the vendor advisory cisco-sa-smb-mult-vuln-KA9PK6D as the first action.
• If patching cannot be completed immediately, remove management and remote access exposure of the RV160/RV260/RV340/RV345 routers from the internet.
• Restrict administrative access to trusted internal networks and disable unused remote management services.
• Monitor Cisco advisories for updated fixed firmware and verify the installed version on each device.
• Replace end-of-support RV series units that no longer receive firmware fixes.

Detection

• Review router logs for unexpected reboots, crashes or service restarts that could indicate exploitation attempts.
• Alert on configuration changes, new administrative accounts or unexpected outbound connections from RV series routers.
• Hunt for known exploitation indicators against these devices using the CISA KEV entry and vendor advisory as reference.
• Inventory all RV160, RV260, RV340 and RV345 devices and confirm firmware versions against the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.