CVE-2022-20701: Cisco Small Business RV Series Routers Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows code execution and privilege elevation on edge routers and is listed in CISA KEV as exploited in the wild, though the local attack vector and required low privileges temper the rating below critical.

What it is

CVE-2022-20701 is a stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787) in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. The advisory groups it with multiple other flaws that can lead to arbitrary code execution, privilege elevation, command execution, authentication bypass, unsigned software execution, or denial of service. It matters because these are edge devices and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who triggers the overflow can execute arbitrary code or commands and elevate privileges on the affected router. That gives control of the device, which can be used to pivot into the network or disrupt connectivity.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the flaw is reached by an attacker who already has some access to the device rather than remotely over the network. The description does not specify the exact interface or service involved.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-03-03 with a remediation due date of 2022-03-17, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.09747 (95th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Cisco updates referenced in the vendor security advisory cisco-sa-smb-mult-vuln-KA9PK6D as soon as possible.
• If patching cannot be done immediately, restrict management access to the routers to trusted networks and disable unused remote management services.
• Limit local accounts and privileges on the devices to reduce the PR:L foothold the vector requires.
• Monitor the CISA KEV due date (2022-03-17) and confirm remediation status for all affected RV160, RV260, RV340, and RV345 units.

Detection

• Review router logs for unexpected process crashes, reboots, or command execution around management sessions.
• Alert on configuration changes or new local accounts created on RV160, RV260, RV340, and RV345 devices.
• Hunt for unauthorized or unsigned software being loaded or executed on these routers.
• Monitor for anomalous outbound traffic or lateral movement originating from the router management interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.