CVE-2022-20707: Cisco RV Series Routers Stack Buffer Overflow and Out-of-Bounds Write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.3 with network, no-auth, no-interaction vector and very high EPSS, though not in KEV and no confirmed in-the-wild exploitation is documented.

What it is

CVE-2022-20707 covers multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers, rooted in stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787). The advisory describes a broad range of outcomes including arbitrary code execution, privilege elevation, command execution, authentication and authorization bypass, unsigned software execution, and denial of service. The record is thin on the specific flaw mechanics, so the exact trigger path is not detailed here.

Impact

An attacker could execute arbitrary code or commands, elevate privileges, bypass authentication and authorization, run unsigned software, or cause a denial of service on the affected router. Given the network-facing nature of these devices, compromise can expose the network edge.

Attack surface

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the flaw is reachable over the network with no authentication and no user interaction. The affected products are small business routers, so the attack surface is the router's network-facing services.

Exploitation

Not listed in CISA KEV and no ransomware group usage is documented. EPSS is very high at 0.75322 (99.489th percentile), and public references include a Packet Storm post titled Authentication Bypass Command Injection plus multiple Zero Day Initiative advisories, indicating public technical detail exists.

What to do

• Apply the Cisco vendor advisory updates for the affected RV160, RV260, RV340, and RV345 firmware.
• Restrict management and remote access interfaces to trusted networks and disable unused services.
• Segment the routers from sensitive internal networks and monitor for anomalous outbound traffic.
• Replace end-of-support RV series devices where no fixed firmware is available.

Detection

• Monitor router logs for authentication bypass attempts and unexpected command execution.
• Alert on unusual outbound connections or unsigned software execution on the router.
• Watch for denial-of-service patterns or repeated crashes/reboots of the device.
• Review traffic to and from router management interfaces for unauthorized access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.