CVE-2022-20699 – This critical vulnerability in Cisco Small Busi... (How to Fix)

Q: What is the severity of CVE-2022-20699?

CVE-2022-20699 has a CVSS score of 10.0 (CRITICAL). This critical vulnerability in Cisco Small Business routers allows unauthenticated remote attackers to execute arbitrary code, bypass authentication, and take full control of affected devices. It affects RV160, RV260, RV340, and RV345 series routers. Attackers can exploit this without any credentials via SSL VPN functionality.

📋 TL;DR

This critical vulnerability in Cisco Small Business routers allows unauthenticated remote attackers to execute arbitrary code, bypass authentication, and take full control of affected devices. It affects RV160, RV260, RV340, and RV345 series routers. Attackers can exploit this without any credentials via SSL VPN functionality.

💻 Affected Systems

Products:

Cisco RV160
Cisco RV260
Cisco RV340
Cisco RV345

Versions: All versions prior to 1.0.03.24

Operating Systems: Cisco IOS-based firmware

Default Config Vulnerable: ⚠️ Yes

Notes: SSL VPN functionality enabled by default makes devices immediately vulnerable to remote exploitation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device compromise allowing attacker to install persistent backdoors, pivot to internal networks, intercept all traffic, and cause permanent damage to router hardware/firmware.

🟠

Likely Case

Remote code execution leading to router takeover, credential theft, network traffic interception, and deployment of malware/botnets.

🟢

If Mitigated

Limited impact if devices are behind firewalls with strict inbound filtering and VPN access is disabled.

🌐 Internet-Facing: HIGH - Directly exploitable from internet without authentication via SSL VPN service.

🏢 Internal Only: HIGH - If attacker gains internal network access, they can exploit this vulnerability to compromise routers.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploit scripts available, including on Packet Storm Security. Exploitation requires no authentication and is straightforward.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.0.03.24 and later

Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Restart Required: Yes

Instructions:

1. Download firmware 1.0.03.24 or later from Cisco website. 2. Log into router web interface. 3. Navigate to Administration > Firmware Upgrade. 4. Upload new firmware file. 5. Wait for upgrade to complete and router to reboot.

🔧 Temporary Workarounds

Disable SSL VPN

all

Temporarily disable SSL VPN functionality to block the primary attack vector

Restrict VPN Access

all

Configure firewall rules to restrict VPN access to trusted IP addresses only

🧯 If You Can't Patch

Immediately disable SSL VPN functionality through web interface
Place routers behind firewalls with strict inbound filtering, blocking all WAN access to VPN ports

🔍 How to Verify

Check if Vulnerable:

Check firmware version in web interface: System Summary > Firmware Version. If version is below 1.0.03.24, device is vulnerable.

Check Version:

No CLI command available. Must check via web interface at System Summary page.

Verify Fix Applied:

Verify firmware version shows 1.0.03.24 or higher after upgrade. Test SSL VPN connectivity to ensure service still works properly.

📡 Detection & Monitoring

Log Indicators:

Unauthenticated SSL VPN connection attempts
Unexpected firmware modification logs
Unusual process execution in system logs

Network Indicators:

Unusual outbound connections from router
VPN port scanning from external IPs
Traffic patterns indicating command and control

SIEM Query:

source="cisco-router" AND (event_type="vpn_auth_failure" OR event_type="firmware_change" OR process="unexpected_executable")

📊 Metadata

CVE ID: CVE-2022-20699

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-121

Published: February 10, 2022

Last Updated: October 28, 2025

🔗 References

http://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-414/ Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-414/ Third Party Advisory,VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20699 US Government Resource

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-20699, you might also want to check these: