Cisco Fixes Vulnerabilities in Business Routers

Cisco patches critical vulnerabilities in its Small Business RV160, RV260, RV340, and RV345 series routers, including bugs that could lead to the execution of arbitrary code with root privileges.

The most severe of these issues is CVE-2022-20699 (CVSS score of 10.0), as it allows an unauthenticated, remote attacker to execute arbitrary code on a vulnerable device by sending malicious HTTP requests to the device that act as SSL VPN gateway.

Cisco has also addressed three flaws in the web-based management interface of the Small Business RV routers tracked as CVE-2022-20700 with CVSS score of 10, CVE-2022-20701 with CVSS score of 9.0, and CVE-2022-20702 with CVSS score of 6.0. Because of insufficient authorization enforcement mechanisms, the flaws can be triggered by submitting specific commands to an affected device.

Few other critical flaw was found in the software image verification feature of Cisco’s small business routers. Tracked as CVE-2022-20703 (CVSS score of 9.3), the bug could allow a local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device,without authentication.

Two other similar issues were also addressed, though they have a severity rating of high (CVE-2022-20707 and CVE-2022-20749, CVSS score of 7.3 each).

Cisco has released software updates to address these vulnerabilities in RV340 and RV345 routers and encourages users to install them, as there are no workarounds to mitigate the bugs. Updates for RV160 and RV260 routers are expected to be released this month.