⚠ Reference material — not professional advice. Test in staging, back up first, verify against your specific version. Use your own judgment for your environment.
● Critical · CVSS 10.0 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2022-20708: Cisco RV Series Router Stack Buffer Overflow

*By Sai Kiran Pandrala*

⚡ At a glance
SeverityCVSS 10.0, Critical
Actively exploited?Yes, listed in CISA KEV (added 2022-03-03)
AffectedCisco Small Business RV160, RV260, RV340, RV345 Series Routers (and the RV160W, RV260W, RV340W, RV345P wireless variants)
Fixed inRV340/RV345 firmware 1.0.03.26 and later. RV160/RV260: see vendor advisory; affected SKUs are end-of-life with no fix planned for some hardware.
Type (CWE)CWE-121: Stack-based Buffer Overflow

⚠️ Cisco's official guidance for some affected SKUs is "replace the hardware." This is one of a bundle of 15 vulnerabilities disclosed in the same advisory. Several have no software fix; the vendor recommends migrating to supported hardware.

What is CVE-2022-20708?

CVE-2022-20708 is one of fifteen vulnerabilities disclosed in a single Cisco PSIRT advisory targeting the Small Business RV160, RV260, RV340, and RV345 Series routers. The shared root cause across the bundle is improper input validation on the web management interface, which leads to memory-corruption primitives an attacker can chain into unauthenticated remote code execution as root on the router.

The bundle includes CVE-2022-20699, 20700, 20701, 20703, 20705, 20707, 20708, 20709, 20710, 20711, 20712, and others. They were all disclosed and assigned by Trend Micro's Zero Day Initiative (ZDI) following Pwn2Own 2021. Working exploit chains for several of these CVEs have been public since early 2022.

Am I affected?

You are affected if you own any of these Cisco Small Business routers:

To check the firmware version:

  1. Log into the router web admin at https://<router-ip>/.
  2. Go to Administration → System Summary (or Status → System Summary depending on model). The firmware version is at the top.

For RV340/RV345 series, the minimum patched firmware is 1.0.03.26 for the CVEs that have fixes available.

For the RV160 and RV260 series specifically, the affected hardware is end-of-life. Cisco's advisory states that the company will not provide software updates for those SKUs to address several of the bundled CVEs, including some in this set. The vendor's remediation guidance for those models is to migrate to a supported product (the Catalyst 1300 series being a common upgrade path).

How to fix CVE-2022-20708

If you have an rv340 or rv345 (has a fix)

  1. Download firmware 1.0.03.26 or later from Cisco's Software Download Center for your specific RV model.
  2. Back up your current configuration from Administration → Backup/Restore Configuration → Download.
  3. Apply the firmware: Administration → File Management → Manual Upgrade → Image. Select the downloaded .img file. The router will reboot, expect 3-5 minutes of downtime.
  4. Verify the firmware version after reboot.

If you have an rv160 or rv260 (no fix planned)

The supported remediation is hardware replacement. Cisco recommends the Catalyst 1300 series as the upgrade path. Interim controls until you can replace:

- Access the router via SSH instead.

- From the GUI: Administration → Remote Access, disable web access from WAN.

These reduce exposure. They do not remediate.

Upgrade the affected Cisco platform


! Verify the running release on the device
show version
show inventory

! Stage the patched image from the Cisco Security Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D
copy tftp://<fileserver>/<patched-image>.bin flash:

! Set the boot image and reload in a maintenance window
configure terminal
boot system flash:<patched-image>.bin
end
write memory
reload

! After reload, confirm the new image is running
show version | include image

Verify the fix landed


# 1. Confirm the running version matches the fixed-in version from the advisory:
#    https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D
#    Use the platform-specific version probe above.

# 2. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS).
#    The scanner should no longer flag CVE-2022-20708 on the patched target.

# 3. Inspect recent service / kernel logs for crash loops or rollback events.
journalctl -u <service> --since "10 minutes ago"
dmesg --since "10 minutes ago"

If you can't patch or replace immediately

For all affected models:

These are bridge controls until hardware replacement or (for RV340/RV345) firmware upgrade.

How to verify the fix worked

  1. Log back into the router web admin.
  2. Administration → System Summary should show firmware 1.0.03.26 or later for RV340/RV345.
  3. Scan the device's WAN-facing IP with a vulnerability scanner, the CVE-2022-20708 plugin should clear if you applied the firmware fix.

For replaced hardware (Catalyst 1300 or other), confirm the old device is decommissioned and its WAN IP is no longer pointing at the vulnerable model.

Frequently asked questions

Other vulnerabilities in the same area that are worth patching alongside this one:

Why is CVE-2022-20708 listed alongside CVE-2022-20699, 20700, 20701, 20703 and others?

All these CVEs come from the same Pwn2Own 2021 disclosure bundle. They share root cause (improper validation in the RV web UI) and the same Cisco advisory. The single firmware upgrade for RV340/RV345 addresses the CVEs that have fixes; the others on the EOL hardware do not.

Is the bundle being exploited?

Yes. CISA's KEV listing on March 3, 2022 covers the Cisco RV Series bundle generally. Public exploit code is available for several of the chains. Internet-exposed RV routers are routinely scanned and targeted.

My RV160 is on the perimeter and I can't replace it this week, what's the absolute minimum?

Disable WAN-side web admin, block 443 inbound at the upstream firewall, and put the router behind a VPN-only management plane. Move the replacement to top priority, these routers were end-of-life before this advisory landed.

References

*This guide was assembled from the official Cisco PSIRT advisory, ZDI disclosure, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against Cisco's advisory before applying changes in production.*