CVE-2022-20708: Cisco Small Business RV Series Routers buffer overflow and command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows code execution and authentication bypass on edge routers and is listed in CISA KEV as exploited in the wild, though the adjacent-network and low-privilege vector limits exposure.

What it is

Cisco Small Business RV160, RV260, RV340 and RV345 Series Routers contain stack-based buffer overflow and OS command injection flaws. Successful exploitation can lead to arbitrary code execution, privilege elevation, authentication bypass, unsigned software execution or denial of service. The advisory aggregates multiple issues, so the exact per-flaw root cause is not detailed in this record.

Impact

An attacker gains the ability to execute arbitrary code or commands on the router, elevate privileges, bypass authentication and authorization, or cause a denial of service.

Attack surface

The CVSS vector is adjacent network (AV:A) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already be on the same network segment and hold some level of access. No remote unauthenticated path is indicated by the vector.

Exploitation

CVE-2022-20708 is listed in CISA KEV with a due date of 2022-03-17, indicating known exploitation in the wild; EPSS 30-day probability is 0.14863 (96.5th percentile). No ransomware campaign use is documented.

What to do

• Apply the Cisco vendor updates referenced in the security advisory cisco-sa-smb-mult-vuln-KA9PK6D as soon as possible.
• Restrict management and data-plane access to the router to trusted internal segments; do not expose the device to untrusted networks.
• Remove or disable unused remote management services and change default credentials.
• Monitor CISA KEV guidance and verify the device is on a supported, patched firmware release.
• Segment the router from critical internal assets to limit lateral movement if it is compromised.

Detection

• Monitor router logs for unexpected reboots, crashes or service restarts that could indicate DoS attempts.
• Alert on configuration changes, new admin accounts or unsigned firmware/software being loaded on the device.
• Watch for anomalous outbound connections or command execution patterns originating from the router.
• Correlate network telemetry for adjacent-segment hosts interacting with the router's management interfaces outside normal administrative windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.