CVE-2023-20073: Cisco RV340/RV345 routers allow unauthenticated arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, and an EPSS probability above 0.90, makes this an urgent exposure for any internet-facing affected router.

What it is

The web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers fails to enforce authorization on file uploads. An unauthenticated remote attacker can send a crafted HTTP request to upload arbitrary files to the device. Because the flaw is remotely reachable without credentials and rated CVSS 9.8, it is a serious exposure for any internet-facing router of these models.

Impact

An attacker can place arbitrary files on the device, which can lead to code execution, persistence, or full compromise of the router. That gives control over routing, VPN, and any traffic passing through the device.

Attack surface

Reached over the network through the router's web-based management interface via a crafted HTTP request. The CVSS vector shows no privileges required and no user interaction, so the attacker only needs network access to the interface.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.901 (99.8th percentile), indicating strong likelihood of exploitation activity. The only references are Cisco vendor advisories, so no public exploit details are provided in this record.

What to do

• Apply the Cisco security advisory fix for the affected RV340, RV340W, RV345, and RV345P firmware as the first action.
• Remove the web management interface from direct internet exposure; restrict access to trusted management networks or VPN only.
• Disable remote management on the WAN interface if it is not operationally required.
• Monitor for and block unexpected HTTP upload requests to the router management interface at the network edge.
• If patching is delayed, isolate affected routers on a segmented management network and review device logs for unauthorized file activity.

Detection

• Inspect HTTP traffic to the router management interface for POST or multipart upload requests that are not part of normal administrative activity.
• Review router file system and logs for unexpected or newly created files, especially in web-accessible directories.
• Alert on management interface access from untrusted or external source IP addresses.
• Correlate router configuration changes or reboots with periods of anomalous HTTP upload traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.