Arbitrary file upload in Cisco Systems, Inc products - CVE-2022-20709
Published: February 3, 2022
Vulnerability identifier: #VU60257
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-20709
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or compromise the affected system.
The vulnerability exists due to improper access restrictions in the web-based management interface. A remote non-authenticated attacker can upload arbitrary files to the device.
Successful exploitation of the vulnerability may allow an attacker to perform a DoS attack by filling up all available space on the device or use the uploaded files in further attacks.Affected software
Cisco RV345P Dual WAN Gigabit VPN Router
Cisco RV345 Dual WAN Gigabit VPN Router
Cisco RV340 Dual WAN Gigabit VPN Router
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router
Cisco RV345 Dual WAN Gigabit VPN Router
Cisco RV340 Dual WAN Gigabit VPN Router
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router
How to mitigate CVE-2022-20709
Install updates from vendor's website.
Cisco RV345P Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV345 Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV340 Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router - update to 1.0.03.26
Cisco RV345 Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV340 Dual WAN Gigabit VPN Router - update to 1.0.03.26
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router - update to 1.0.03.26