CVE-2022-20705: Cisco RV Series Routers Buffer Overflow and Out-of-Bounds Write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication or user interaction, and very high EPSS predicted exploitation make this an urgent edge-device flaw.

What it is

CVE-2022-20705 is a critical vulnerability in Cisco Small Business RV160, RV260, RV340 and RV345 Series Routers, rooted in a stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787). The advisory groups it with multiple flaws that can lead to arbitrary code execution, privilege elevation, command execution, authentication bypass, unsigned software execution or denial of service. It matters because these are internet-facing edge devices with a CVSS base score of 9.8 and no privileges or user interaction required.

Impact

An unauthenticated remote attacker can potentially execute arbitrary code or commands, elevate privileges, bypass authentication and authorization, or cause a denial of service on the affected router.

Attack surface

Reachable over the network via the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are needed. The record does not specify which service or interface is targeted beyond the affected router firmware.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.80031 (99.594th percentile), indicating strong predicted exploitation activity. Reference tags include Vendor Advisory and Third Party Advisory/VDB Entry, and a Packet Storm post references Cisco RV Series authentication bypass and command injection, but the record does not confirm in-the-wild exploitation.

What to do

• Apply the Cisco security advisory cisco-sa-smb-mult-vuln-KA9PK6D firmware updates for all affected RV160, RV260, RV340 and RV345 models.
• If patching is not immediately possible, disable remote management and restrict WAN access to the router web interface.
• Place affected routers behind a firewall and limit management access to trusted internal networks only.
• Monitor Cisco advisory updates and replace end-of-support RV models that will not receive fixes.
• Review router configuration for exposed services and remove any unnecessary internet-facing management interfaces.

Detection

• Monitor router and perimeter logs for unexpected authentication bypass attempts or anomalous command execution on RV series devices.
• Alert on unusual outbound connections or new listening services originating from RV router management IPs.
• Check firmware versions against the Cisco advisory to identify unpatched RV160, RV260, RV340 and RV345 devices.
• Watch for crash or reboot patterns consistent with denial-of-service attempts against the router web interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.