Main Vulnerability Database Vulnerabilities #VU60252

Improper Authentication in Cisco Systems, Inc products - CVE-2022-20705

Published: February 2, 2022 / Updated: February 15, 2023

Vulnerability identifier: #VU60252

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20705

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the session management of the web UI. A remote non-authenticated attacker can brute force to determine a current session identifier and then reuse it to take over an ongoing session or by crafting a new, valid session identifier and bypassing the whole authentication mechanism.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected device.

Affected software

Cisco RV345P Dual WAN Gigabit VPN Router
Cisco RV345 Dual WAN Gigabit VPN Router
Cisco RV340 Dual WAN Gigabit VPN Router
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router
Cisco Small Business RV160 Series VPN Router
Cisco Small Business RV260W Wireless-AC VPN Router
Cisco Small Business RV260P VPN Router with POE
Cisco Small Business RV260 VPN Router
Cisco Small Business RV160W Wireless-AC VPN Router

How to mitigate CVE-2022-20705

Install updates from vendor's website.

Cisco RV345P Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV345 Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV340 Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router - update to 1.0.03.26

Links to Public Exploits and PoC-codes

External References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D