Cisco · Small Business RV160, RV260, RV340, and RV345 Series Routers
CVE-2022-20708
Cisco Small Business RV Series Routers Vulnerabilities
Qué es
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
CISA: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 17 de marzo de 2022
Más fallos explotados de Cisco
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 3 mar 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Crítica 10,0 | 72% |
| 3 mar 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Crítica 10,0 | 5,7% |
| 3 mar 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Crítica 10,0 | 9,7% |
| 3 mar 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Crítica 10,0 | 9,2% |
| 14 oct 2026 | Relative Path Traversal | Secure Email Gateway | Crítica 9,8 | 2,2% |
| 30 sept 2026 | Hex Encoding | Catalyst SD-WAN Manager | Crítica 9,8 | 39% |
| 16 sept 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Crítica 10,0 | 76% |
| 14 sept 2026 | SQL Injection | Secure Email Gateway | Crítica 9,8 | 30% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.