CVE-2022-20699VulnerabilityPublished 03/03/2022Updated 10/24/2026

CVE-2022-20699: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Affects Cisco Small Business RV160, RV260, RV340, and RV345 Series RoutersSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/03/2022
KEV deadline: 03/17/2022
EPSS: 72.5% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2022-20699 (opens in a new tab)

Description

Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers contain a stack-based buffer overflow vulnerability that can be exploited to execute arbitrary code, elevate privileges, bypass authentication and authorization, run unsigned software, or cause denial of service. This vulnerability has been exploited in the wild. No explicit patch information is provided in the input data.

Summary

CVE-2022-20699 is a stack-based buffer overflow vulnerability affecting Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Successful exploitation can allow attackers to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service conditions. The vulnerability is known to be exploited in the wild. The vulnerability is categorized under CWE-785 (Improper Control of Exceptional Conditions).

Impact

Exploitation of this vulnerability can lead to full compromise of affected routers, including arbitrary code execution, privilege escalation, bypassing of security controls, and denial of service. This can disrupt network operations and potentially allow attackers to control network traffic or devices behind the routers.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor Cisco's official advisories for updates and apply any available fixes promptly. Until a patch is available, consider limiting network exposure of affected devices and applying network-level protections where feasible.

Weaknesses

CWE-785Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:41:32 UTC

Weaknesses

References

Related threats