{"id":"CVE-2022-20699","published":"2022-02-10T18:15:08Z","modified":"2026-06-17T04:24:53Z","title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","tier":"core","eol":null,"description":{"text":"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a stack-based buffer overflow in the Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers, arising from improper validation of input quantities and an unbounded path-manipulation buffer. An attacker with network access and no authentication or user interaction can exploit it to execute arbitrary code, elevate privileges, bypass authentication and authorization, run unsigned software, or cause a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:50Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.72458,"percentile":0.99438,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-20699","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-03","exploitedFirstSeen":"2022-03-03","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-1284","name":"Improper Validation of Specified Quantity in Input"},{"id":"CWE-121","name":"Stack-based Buffer Overflow"},{"id":"CWE-785","name":"Use of Path Manipulation Function without Maximum-sized Buffer"}],"references":[{"url":"http://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-22-414/","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-22-414/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20699","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by a remote, unauthenticated attacker by \"sending a specially crafted HTTP request to a vulnerable device that is acting as an SSL VPN Gateway.” This can be performed due to insufficient boundary checks when processing specific HTTP requests. If exploited, this could grant root privileges to the attacker. ","confidence":"high"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by a remote, unauthenticated attacker by \"sending a specially crafted HTTP request to a vulnerable device that is acting as an SSL VPN Gateway.” This can be performed due to insufficient boundary checks when processing specific HTTP requests. If exploited, this could grant root privileges to the attacker. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-25949","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25949","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2022-02-07","earliestUrl":"https://github.com/Audiobahn/CVE-2022-20699","repos":[{"name":"Audiobahn/CVE-2022-20699","url":"https://github.com/Audiobahn/CVE-2022-20699","stars":238,"created":"2022-02-07"}]},"metasploit":[{"name":"Cisco RV340 SSL VPN Unauthenticated Remote Code Execution","module":"exploit/linux/misc/cisco_rv340_sslvpn","type":"exploit","disclosureDate":"2022-02-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/cisco_rv340_sslvpn.rb"}],"first":{"date":"2022-02-02","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/cisco_rv340_sslvpn.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/167113/Cisco-RV340-SSL-VPN-Unauthenticated-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1059.004"],"provenance":"source"}],"timeline":[{"date":"2022-02-02","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-02-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/cisco_rv340_sslvpn.rb","provenance":"source"},{"date":"2022-02-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20699","provenance":"source"},{"date":"2022-03-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25949","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":21},"priority":{"score":69.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1701 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9944"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}