CVE-2022-20708 encompasses multiple critical vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. These flaws allow attackers to execute arbitrary code or commands, elevate privileges, bypass authentication, fetch unsigned software, and cause denial of service. With a CVSS score of 8.0 (HIGH), the vulnerabilities are remotely exploitable with low complexity and can lead to complete compromise of confidentiality, integrity, and availability. Notably, this CVE is listed in CISA's KEV catalog, indicating active exploitation in the wild, despite no public Metasploit or ExploitDB modules. The high EPSS score and significant community discussion (14 mentions) further underscore its importance and the urgency for patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.03.24CPE matchmatch criteria | cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:* | ||
<= 1.0.03.24CPE matchmatch criteria | cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:* | ||
<= 1.0.03.24CPE matchmatch criteria | cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:* | ||
<= 1.0.03.24CPE matchmatch criteria | cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.