ZeroDay Findings
Sign inSign up

Findings

CVE-2022-20699

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Published Feb 10, 2022 · updated Jun 16, 2026 · cisco rv340 firmware

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 10, 2022 · Catalog

    Detected

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details sect

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 17, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details sect

Required action

Apply updates per vendor instructions.

CISA due date Mar 17, 2022

Affected

  • cpe cisco/rv340 firmwareversion unspecified
  • cpe cisco/rv340w firmwareversion unspecified
  • cpe cisco/rv345 firmwareversion unspecified
  • cpe cisco/rv345p firmwareversion unspecified
  • vendor Cisco Small Business RV160, RV260, RV340, and RV345 Series Routersversion unspecified

Sources

  • CISA KEVCVE-2022-20699

    A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

    cisa.gov
  • CVE.orgCVE-2022-20699

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-20699

    30-day exploitation probability 72.5%

    first.org
  • Metasploit Modulesexploit_linux/misc/cisco_rv340_sslvpn

    Public module reference (good). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2022-20699

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and ru

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References