CVE-2022-20703 — Vulnetix

CVE-2022-20703 PUBLISHED KEV CVSS 10 CRITICAL

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

EPSS 2.00% · 84.0th percentile

Risk Scores

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score

2.00%

84.0th percentile

Affected Products

Vendor	Product	Versions
cisco	rv345p_firmware	0, 0, 0
cisco	rv260_firmware	0, 0, 0
cisco	rv340_firmware	0, 0, 0
Cisco	Cisco Small Business RV Series Router Firmware	n/a, n/a
cisco	rv340w_firmware	0, 0, 0
cisco	rv345_firmware	0, 0, 0
cisco	rv160_firmware	0, 0, 0
cisco	rv160w_firmware	0, 0, 0
cisco	rv260p_firmware	0, 0, 0
cisco	rv260w_firmware	0, 0, 0

Exploit Intelligence

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20699 (circl)
https://www.zerodayinitiative.com/advisories/ZDI-22-414/ (circl)
http://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.html (circl)
CIRCL seen: CVE-2022-20699 (circl-sighting)
CIRCL exploited: CVE-2022-20699 (circl-sighting)
CIRCL seen: CVE-2022-20699 (circl-sighting)
CIRCL seen: CVE-2022-20699 (circl-sighting)
CIRCL seen: CVE-2022-20699 (circl-sighting)
CIRCL seen: CVE-2022-20699 (circl-sighting)
CIRCL seen: CVE-2022-20699 (circl-sighting)

…and 18 more exploits

Timeline

Feb 3, 2022 CVE Published
Feb 11, 2022 EPSS Score
Feb 17, 2022 EPSS Score
Mar 3, 2022 CISA KEV Added
May 11, 2022 PoC Published
May 27, 2022 EPSS Score
Jul 19, 2022 EPSS Score
Nov 1, 2022 EPSS Score
Dec 23, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Apr 7, 2023 EPSS Score
Jun 14, 2023 PoC Published

References

Open in Interactive Console →