CVE-2022-20705

CRITICAL EXPLOITED

Cisco Rv340 Firmware < 1.0.03.24 - Out-of-Bounds Write

Title source: rule

Description

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Exploits (1)

metasploit WORKING POC EXCELLENT

by Biem Pham, Neterum, jbaines-r7 · rubypocunix

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cisco_rv340_lan.rb

View Code ZIP pw:eip

References (5)

[Vendor Advisory] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

[Third Party Advisory, VDB Entry] https://www.zerodayinitiative.com/advisories/ZDI-22-409/

[Third Party Advisory, VDB Entry] https://www.zerodayinitiative.com/advisories/ZDI-22-410/

[Third Party Advisory, VDB Entry] https://www.zerodayinitiative.com/advisories/ZDI-22-415/

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/170988/Cisco-RV-Series-Authentication-Bypass-Command-Injection.html

Scores

CVSS v3 10.0

EPSS 0.8021

EPSS Percentile 99.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

VulnCheck KEV 2025-09-03

CWE

CWE-121 CWE-787

Status published

Products (9)

cisco/rv160_firmware < 1.0.01.05

cisco/rv160w_firmware < 1.0.01.05

cisco/rv260_firmware < 1.0.01.05

cisco/rv260p_firmware < 1.0.01.05

cisco/rv260w_firmware < 1.0.01.05

cisco/rv340_firmware < 1.0.03.24

cisco/rv340w_firmware < 1.0.03.24

cisco/rv345_firmware < 1.0.03.24

cisco/rv345p_firmware < 1.0.03.24

Published Feb 10, 2022

Tracked Since Feb 18, 2026