CVE-2022-20703: Cisco Small Business RV Series Routers stack-based buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA KEV with known exploitation and a CVSS base score of 8.0, but it requires adjacent-network access and user interaction, which limits mass remote exploitation.

What it is

CVE-2022-20703 covers multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340 and RV345 Series Routers, including a stack-based buffer overflow (CWE-121) and improper certificate validation (CWE-295). Successful exploitation can lead to arbitrary code execution, privilege elevation, command execution, authentication bypass, unsigned software execution or denial of service. The advisory is a grouped Cisco bulletin, so the description does not isolate which specific defect maps to which outcome.

Impact

An attacker could execute arbitrary code or commands, elevate privileges, bypass authentication and authorization, run unsigned software, or cause a denial of service on the affected router.

Attack surface

The CVSS vector is AV:A (adjacent network), AC:L, PR:N, UI:R, meaning the attacker must be on the same network segment and must rely on some form of user interaction; no prior authentication is required. The record does not specify the exact interface or protocol used to reach the flaw.

Exploitation

CVE-2022-20703 is listed in CISA KEV with a due date of 2022-03-17, indicating known exploitation in the wild; EPSS 30-day probability is about 9.2 percent (95th percentile). No ransomware campaign use is documented.

What to do

• Apply the Cisco firmware updates referenced in the vendor advisory cisco-sa-smb-mult-vuln-KA9PK6D as the first action.
• If patching cannot be completed immediately, restrict management and adjacent-network access to the affected RV160, RV260, RV340 and RV345 routers.
• Disable unused remote management and services on these routers to reduce the reachable attack surface.
• Monitor Cisco advisory updates for any revised fixed firmware versions, since the record does not list specific affected or fixed releases.

Detection

• Review router logs for unexpected reboots, crashes or service restarts that could indicate a denial-of-service attempt.
• Alert on anomalous outbound connections or unexpected processes on the router that may indicate code execution or unsigned software running.
• Monitor for authentication or authorization bypass attempts against the router management interface from adjacent hosts.
• Track CISA KEV status and Cisco advisory updates for this CVE to confirm exposure and remediation progress.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.