Cisco Small Business RV Series Routers Stack-based Buffer Overflow
CVE-2022-20703 is a high-severity improper certificate validation vulnerability in Cisco Small Business RV Series Router Firmware from Cisco, with a CVSS 3.1 base score of 8.0 out of 10. It can be exploited from the same local network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. CISA added it to the Known Exploited Vulnerabilities catalogue on March 3, 2022, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of Cisco Small Business RV Series Router Firmware you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply updates per vendor instructions.
- Read the advisory on tools.cisco.com for workarounds and exact fixed builds.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Cisco | Cisco Small Business RV Series Router Firmware | Not specified in the record | Not stated |
| Cisco | Rv340 Firmware | 1.0.03.24 and earlier | Not stated |
| Cisco | Rv340w Firmware | 1.0.03.24 and earlier | Not stated |
| Cisco | Rv345 Firmware | 1.0.03.24 and earlier | Not stated |
| Cisco | Rv345p Firmware | 1.0.03.24 and earlier | Not stated |
| Cisco | Rv160 Firmware | 1.0.01.05 and earlier | Not stated |
| Cisco | Rv160w Firmware | 1.0.01.05 and earlier | Not stated |
| Cisco | Rv260 Firmware | 1.0.01.05 and earlier | Not stated |
| Cisco | Rv260p Firmware | 1.0.01.05 and earlier | Not stated |
| Cisco | Rv260w Firmware | 1.0.01.05 and earlier | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- AdjacentThe attacker must be on the same local network segment.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 10.0 | Critical | CNA (cisco.com) |
| CVSS 3.1 | 8.0 | High | NVD |
| CVSS 2.0 | 7.2 | High | NVD |
Official description
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How developers prevent this class of flaw
- Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
More Improper Certificate Validation vulnerabilities (CWE-295)
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Advisories
Third-party and government advisories
- zerodayinitiative.com/advisories/ZDI-22-408/Third Party Advisory, VDB Entry
- zerodayinitiative.com/advisories/ZDI-22-413/Third Party Advisory, VDB Entry
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20703US Government Resource
Other vulnerabilities in Cisco Small Business RV Series Router Firmware
- 9.1 Critical severity
- 9.1 Critical severity
- 9.1 Critical severity
- 9.1 Critical severity
- 7.2 High severity
- 8.8 High severity
Recent Improper Certificate Validation vulnerabilities
- 7.4 High severity
- 8.1 High severity
Microsoft Windows CryptoAPI Spoofing Exploited
Spotted an error? Tell us.