CVE-2022-20706 encompasses multiple critical vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. These flaws allow unauthenticated attackers to execute arbitrary code, elevate privileges, bypass security protections, and cause denial of service. With a CVSS score of 8.1 (High), the vulnerabilities are network-exploitable with high impact on confidentiality, integrity, and availability, though with high attack complexity. While not listed in CISA KEV, media coverage and community discussion indicate significant attention, and public articles suggest exploit availability, despite no Metasploit or ExploitDB modules.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.03.24CPE matchmatch criteria | cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:* | ||
<= 1.0.03.24CPE matchmatch criteria | cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:* | ||
<= 1.0.03.24CPE matchmatch criteria | cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:* | ||
<= 1.0.03.24CPE matchmatch criteria | cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:* | ||
<= 1.0.01.05CPE matchmatch criteria | cpe:2.3:o:cisco:rv160_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.