Cisco fixes critical remote code execution bug in VPN routers

Cisco has fixed critical security vulnerabilities affecting Small Business VPN routers and enabling unauthenticated, remote attackers to execute arbitrary code or commands and trigger denial of service conditions on vulnerable devices.

Successful exploitation of CVE-2022-20842 with crafted HTTP input could allow attackers “To execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition,” the company explains.

The complete list of routers affected by these bugs includes Small Business RV160, RV260, RV340, and RV345 series VPN routers.

The company’s Product Security Incident Response Team said Cisco is unaware of active exploitation or publicly available exploits in the wild.

Today, Cisco has also patched a third, high severity bug in the Open Plug and Play module of RV160, RV260, RV340, and RV345 series routers.

Last month, Cisco addressed another set of severe security bugs in the Cisco Nexus Dashboard data center management solution that let unauthenticated attackers execute commands and perform actions remotely with root or Administrator privileges.

Share this article on social media:

Subscribe to Our Newsletter!

Stay on top of cybersecurity risks, evolving threats and industry news.

The Latest Cybersecurity News

From major cyberattacks, newly discovered critical vulnerabilities to recommended best practices, read it here first:

Tell us about your needs.
Get an answer the same business day.

Tell us about your needs.
Get an answer the same business day.

Fill out the form below and get an answer from our experts within 1 business day.
Got an urgent request? Call us at 1-877-805-7475 or Book a meeting.

What happens next:

  • We reach out to learn about your objectives
  • We work together to define your project's scope
  • You get an all-inclusive, no engagement proposal

Scroll to Top

BOOK A MEETING WITH AN EXPERT

Enter Your Corporate Email