CVE-2023-20025 is a critical authentication bypass vulnerability affecting the web-based management interface of several end-of-life Cisco Small Business RV series routers (RV016, RV042, RV042G, RV082). This flaw, stemming from improper user input validation, allows an unauthenticated, remote attacker to gain root access to the underlying operating system by sending a crafted HTTP request. With a CVSS score of 9.8, the vulnerability is highly severe, requiring no user interaction or prior authentication. While there is no known active exploitation in the wild or public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered significant community discussion and media coverage, indicating high awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:rv016_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:rv042_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:rv042g_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:rv082_firmware:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.