CVE-2022-20699Cisco Small Business RV Series Routers Vulnerabilities
Updated under an hour ago ()
Does this affect you?
It affects Cisco Small Business RV Series Router Firmware and 4 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Mar 3, 2022; federal agencies had to remediate by Mar 17, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
- CVSS
- 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-121
- Known exploited
- Added to CISA KEV Mar 3, 2022; federal remediation due Mar 17, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 72.46% (percentile 99)
- Assigned by
- cisco
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Cisco Cisco Small Business RV Series Router Firmware cisco:small_business_rv_series_router_firmware (from the name) | all versions | CNA record |
cisco rv340_firmware cisco:rv340_firmware | through 1.0.03.24 | NVD |
cisco rv340w_firmware cisco:rv340w_firmware | through 1.0.03.24 | NVD |
cisco rv345_firmware cisco:rv345_firmware | through 1.0.03.24 | NVD |
cisco rv345p_firmware cisco:rv345p_firmware | through 1.0.03.24 | NVD |
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6Dvendor-advisory, x-refsource-cisco
- https://www.zerodayinitiative.com/advisories/ZDI-22-414/x-refsource-misc, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20699us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.