CVE-2022-20700

This advisory bundles multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 routers, and the combined effect is about as bad as it gets: an attacker can execute arbitrary code, elevate privileges, run arbitrary commands, bypass authentication and authorization, load and run unsigned software, and cause denial of service. The stack-based buffer overflows behind it, reachable remotely with no authentication and a changed scope, mean the router — the network's edge and gateway — can be fully taken over from outside.

Small-business routers are a perennial mass-exploitation target because they're internet-facing by function, often run with default or forgotten management exposure, and are seldom patched by the small organizations that own them. Unauthenticated RCE on the gateway is exactly what botnets and access brokers hunt for: a compromised edge router yields traffic interception, persistence outside the reach of host security tools, and a pivot into everything behind it. The ability to load unsigned software is especially grim, since it enables durable, firmware-level implants.

Our angle is internet-reachability triage first, because these devices live at the perimeter. We'd inventory any RV160/RV260/RV340/RV345 in scope and immediately determine whether their web management is exposed to the internet, restricting it and applying Cisco's fixed firmware as the priority action. Given the caliber of the bug and the target class, we'd rank exposed units at the very top and, because edge devices get compromised early and quietly, look for signs of tampering rather than assume a clean patch is the end of it.