CVE-2022-20842 - OpenCVE

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Rv340 Rv340 Firmware Rv340w Rv340w Firmware Rv345 Rv345 Firmware Rv345p Rv345p Firmware

Configuration 1 [-]

AND

cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR

History

No history.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2022-08-10T08:10:21.657918Z

Updated: 2024-09-17T01:21:15.227Z

Reserved: 2021-11-02T00:00:00

Link: CVE-2022-20842

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-08-10T09:15:08.590

Modified: 2023-11-07T03:43:06.253

Link: CVE-2022-20842

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Cisco Small Business RV Series Router Firmware", "vendor": "Cisco", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2022-08-03T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "description": "CWE-120", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-10T08:10:21", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "20220803 Cisco Small Business RV Series Routers Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR"}], "source": {"advisory": "cisco-sa-sb-mult-vuln-CbVp4SUR", "defect": [["CSCwb58268", "CSCwb58273", "CSCwb98961", "CSCwb98964", "CSCwc00210"]], "discovery": "INTERNAL"}, "title": "Cisco Small Business RV Series Routers Vulnerabilities", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "DATE_PUBLIC": "2022-08-03T23:00:00", "ID": "CVE-2022-20842", "STATE": "PUBLIC", "TITLE": "Cisco Small Business RV Series Routers Vulnerabilities"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cisco Small Business RV Series Router Firmware", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "Cisco"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}]}, "exploit": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "impact": {"cvss": {"baseScore": "9.8", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-120"}]}]}, "references": {"reference_data": [{"name": "20220803 Cisco Small Business RV Series Routers Vulnerabilities", "refsource": "CISCO", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR"}]}, "source": {"advisory": "cisco-sa-sb-mult-vuln-CbVp4SUR", "defect": [["CSCwb58268", "CSCwb58273", "CSCwb98961", "CSCwb98964", "CSCwc00210"]], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T02:24:49.953Z"}, "title": "CVE Program Container", "references": [{"name": "20220803 Cisco Small Business RV Series Routers Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR"}]}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2022-20842", "datePublished": "2022-08-10T08:10:21.657918Z", "dateReserved": "2021-11-02T00:00:00", "dateUpdated": "2024-09-17T01:21:15.227Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BE28C05-F476-4D81-AC78-782E2C4AEAAE", "versionEndExcluding": "1.0.03.28", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A4411AC-2A74-4315-BA6B-D7E1AA538BDB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "700C05A8-7A02-4805-8068-0D1A942CB867", "versionEndExcluding": "1.0.03.28", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*", "matchCriteriaId": "21E55019-F969-4ACD-A6C8-1D2EE05F8EE4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "43E19746-004F-420C-A305-A3251986DB5C", "versionEndExcluding": "1.0.03.28", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*", "matchCriteriaId": "5E91E68B-CBE9-462E-82D4-6F588B8E84E8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB520B21-E5E4-46B1-8485-561721D45272", "versionEndExcluding": "1.0.03.28", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*", "matchCriteriaId": "5120BAB7-FB3A-481E-9ECD-48341846AFBD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}, {"lang": "es", "value": "Varias vulnerabilidades en los routers Cisco Small Business de las series RV160, RV260, RV340 y RV345 podr\u00edan permitir a un atacante remoto no autenticado ejecutar c\u00f3digo arbitrario o causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. Para obtener m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"}], "id": "CVE-2022-20842", "lastModified": "2023-11-07T03:43:06.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 6.0, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2022-08-10T09:15:08.590", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}