Cisco · Small Business RV160, RV260, RV340, and RV345 Series Routers
CVE-2022-20708
Cisco Small Business RV Series Routers Vulnerabilities
What it is
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
CISA: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 17, 2022
More exploited flaws from Cisco
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 72% |
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 5.7% |
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 9.7% |
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 9.2% |
| Oct 14, 2026 | Relative Path Traversal | Secure Email Gateway | Critical 9.8 | 2.2% |
| Sep 30, 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critical 9.8 | 39% |
| Sep 16, 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critical 10.0 | 76% |
| Sep 14, 2026 | SQL Injection | Secure Email Gateway | Critical 9.8 | 30% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.