CVE-2023-20250: Cisco Small Business RV Series Router Firmware · Stack-based Buffer Overflow
Affects Cisco Small Business RV Series Router FirmwareSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 60% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 6 Sep 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Small Business RV Series Router Firmware | Affected
| Fixed in– |
AI-suggested
Organizations should immediately verify if they use any affected Cisco Small Business RV Series router models and identify the firmware versions in use. Cisco should be consulted for available patches or firmware updates addressing this vulnerability; if patches are not yet available, organizations should apply any recommended workarounds or mitigations from Cisco advisories. Restricting access to the web-based management interface is critical—this includes limiting administrative access to trusted internal networks or VPNs, disabling remote management if not necessary, and enforcing strong, unique administrator passwords. Implement network segmentation to isolate management interfaces from general user networks. Regularly audit and monitor router logs for suspicious administrative activity. Employ multi-factor authentication (MFA) for administrative access where supported. Additionally, organizations should conduct credential hygiene reviews to ensure administrator credentials have not been compromised. Finally, prepare incident response plans to quickly address potential exploitation attempts.
Description
CVE-2023-20250 is a stack-based buffer overflow vulnerability in the web-based management interface of Cisco Small Business RV Series routers, including models RV110W, RV130, RV130W, and RV215W. An authenticated attacker with valid administrator credentials can exploit this flaw by sending crafted requests to the interface, resulting in arbitrary code execution with root privileges. The vulnerability affects multiple firmware versions and does not require user interaction beyond authentication. Although the CVSS score is 6.5 (medium severity), the impact on confidentiality and integrity is high due to root-level code execution. No known exploits are currently reported in the wild. European organizations using these routers should prioritize patching and restrict administrative access to mitigate risk. Countries with significant Cisco Small Business router deployments and critical infrastructure reliance on these devices are more likely to be impacted.