Improper Authorization in Cisco Systems, Inc products - CVE-2022-20701

Vulnerability identifier: #VU60248

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20701

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization in the web-management interface. A remote non-authenticated attacker can execute arbitrary code with root privileges.

Cisco RV345P Dual WAN Gigabit VPN Router
Cisco RV345 Dual WAN Gigabit VPN Router
Cisco RV340 Dual WAN Gigabit VPN Router
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router
Cisco Small Business RV160 Series VPN Router
Cisco Small Business RV260W Wireless-AC VPN Router
Cisco Small Business RV260P VPN Router with POE
Cisco Small Business RV260 VPN Router
Cisco Small Business RV160W Wireless-AC VPN Router

Install updates from vendor's website.

Cisco RV345P Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV345 Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV340 Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router - update to 1.0.03.26

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

• Multiple vulnerabilities in Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers
• Multiple vulnerabilities in Cisco Small Business RV Series Routers