Details of VAR-202202-0323

ID

VAR-202202-0323

CVE

CVE-2022-20703

TITLE

plural Cisco Small Business RV Series router out-of-bounds write vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-004543

DESCRIPTION

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory. plural Cisco Small Business RV Series routers contain an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of a firmware image when performing an upgrade. An attacker can leverage this vulnerability to execute code in the context of root

Trust: 2.97

sources: NVD: CVE-2022-20703 // JVNDB: JVNDB-2022-004543 // ZDI: ZDI-22-413 // ZDI: ZDI-22-408 // VULMON: CVE-2022-20703

AFFECTED PRODUCTS

vendor:	cisco	model:	rv340	scope:	-	version:	-	Trust: 1.4
vendor:	cisco	model:	rv160	scope:	lte	version:	1.0.01.05	Trust: 1.0
vendor:	cisco	model:	rv345p	scope:	lte	version:	1.0.03.24	Trust: 1.0
vendor:	cisco	model:	rv260	scope:	lte	version:	1.0.01.05	Trust: 1.0
vendor:	cisco	model:	rv340w	scope:	lte	version:	1.0.03.24	Trust: 1.0
vendor:	cisco	model:	rv345	scope:	lte	version:	1.0.03.24	Trust: 1.0
vendor:	cisco	model:	rv160w	scope:	lte	version:	1.0.01.05	Trust: 1.0
vendor:	cisco	model:	rv260w	scope:	lte	version:	1.0.01.05	Trust: 1.0
vendor:	cisco	model:	rv260p	scope:	lte	version:	1.0.01.05	Trust: 1.0
vendor:	cisco	model:	rv340	scope:	lte	version:	1.0.03.24	Trust: 1.0
vendor:	シスコシステムズ	model:	rv160w wireless-ac vpn router	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv340w dual wan gigabit wireless-ac vpn router	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv260w wireless-ac vpn router	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv260 vpn router	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv345p dual wan gigabit poe vpn router	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv345 dual wan gigabit vpn router	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv160 vpn router	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv260p vpn router with poe	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv340 dual wan gigabit vpn router	scope:	-	version:	-	Trust: 0.8

sources: ZDI: ZDI-22-413 // ZDI: ZDI-22-408 // JVNDB: JVNDB-2022-004543 // NVD: CVE-2022-20703

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2022-20703
value:	HIGH
Trust: 1.4
nvd@nist.gov:	CVE-2022-20703
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2022-20703
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2022-20703
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202202-164
value:	HIGH
Trust: 0.6
VULMON:	CVE-2022-20703
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2022-20703
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

nvd@nist.gov:	CVE-2022-20703
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.1
impactScore:	5.9
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2022-20703
baseSeverity:	CRITICAL
baseScore:	10.0
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	6.0
version:	3.1
Trust: 1.0
NVD:	CVE-2022-20703
baseSeverity:	HIGH
baseScore:	8.4
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8
ZDI:	CVE-2022-20703
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 0.7
ZDI:	CVE-2022-20703
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-22-413 // ZDI: ZDI-22-408 // VULMON: CVE-2022-20703 // JVNDB: JVNDB-2022-004543 // CNNVD: CNNVD-202202-164 // NVD: CVE-2022-20703 // NVD: CVE-2022-20703

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	CWE-295	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-004543 // NVD: CVE-2022-20703

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202202-164

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202202-164

PATCH

title:	Cisco has issued an update to correct this vulnerability.	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D	Trust: 1.4
title:	cisco-sa-smb-mult-vuln-KA9PK6D	url:	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D	Trust: 0.8
title:	Cisco Small Business Buffer error vulnerability fix	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=183257	Trust: 0.6
title:	Cisco: Cisco Small Business RV Series Routers Vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-smb-mult-vuln-KA9PK6D	Trust: 0.1
title:	Known Exploited Vulnerabilities Detector	url:	https://github.com/Ostorlab/KEV	Trust: 0.1
title:	CVE-2022-XXXX	url:	https://github.com/AlphabugX/CVE-2022-23305	Trust: 0.1
title:	CVE-2022-XXXX	url:	https://github.com/AlphabugX/CVE-2022-RCE	Trust: 0.1
title:	Threatpost	url:	https://threatpost.com/critical-cisco-bugs-vpn-routers-cyberattacks/178199/	Trust: 0.1

sources: ZDI: ZDI-22-413 // ZDI: ZDI-22-408 // VULMON: CVE-2022-20703 // JVNDB: JVNDB-2022-004543 // CNNVD: CNNVD-202202-164

EXTERNAL IDS

db:	NVD	id:	CVE-2022-20703	Trust: 4.7
db:	ZDI	id:	ZDI-22-413	Trust: 2.4
db:	ZDI	id:	ZDI-22-408	Trust: 2.4
db:	JVNDB	id:	JVNDB-2022-004543	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-15810	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-15611	Trust: 0.7
db:	CS-HELP	id:	SB2022020301	Trust: 0.6
db:	CNNVD	id:	CNNVD-202202-164	Trust: 0.6
db:	VULMON	id:	CVE-2022-20703	Trust: 0.1

sources: ZDI: ZDI-22-413 // ZDI: ZDI-22-408 // VULMON: CVE-2022-20703 // JVNDB: JVNDB-2022-004543 // CNNVD: CNNVD-202202-164 // NVD: CVE-2022-20703

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-smb-mult-vuln-ka9pk6d	Trust: 3.1
url:	https://www.zerodayinitiative.com/advisories/zdi-22-408/	Trust: 2.4
url:	https://www.zerodayinitiative.com/advisories/zdi-22-413/	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2022-20703	Trust: 1.4
url:	https://www.cybersecurity-help.cz/vdb/sb2022020301	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/295.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://threatpost.com/critical-cisco-bugs-vpn-routers-cyberattacks/178199/	Trust: 0.1

sources: ZDI: ZDI-22-413 // ZDI: ZDI-22-408 // VULMON: CVE-2022-20703 // JVNDB: JVNDB-2022-004543 // CNNVD: CNNVD-202202-164 // NVD: CVE-2022-20703

CREDITS

Bien Pham (@bienpnn) from Team Orca of Sea Security (security.sea.com)

Trust: 1.3

sources: ZDI: ZDI-22-408 // CNNVD: CNNVD-202202-164

SOURCES

db:	ZDI	id:	ZDI-22-413
db:	ZDI	id:	ZDI-22-408
db:	VULMON	id:	CVE-2022-20703
db:	JVNDB	id:	JVNDB-2022-004543
db:	CNNVD	id:	CNNVD-202202-164
db:	NVD	id:	CVE-2022-20703

LAST UPDATE DATE

2024-08-14T13:53:35.798000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-22-413	date:	2022-02-22T00:00:00
db:	ZDI	id:	ZDI-22-408	date:	2022-02-22T00:00:00
db:	VULMON	id:	CVE-2022-20703	date:	2023-11-07T00:00:00
db:	JVNDB	id:	JVNDB-2022-004543	date:	2023-04-18T04:41:00
db:	CNNVD	id:	CNNVD-202202-164	date:	2023-06-28T00:00:00
db:	NVD	id:	CVE-2022-20703	date:	2024-07-24T13:35:37.437

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-22-413	date:	2022-02-22T00:00:00
db:	ZDI	id:	ZDI-22-408	date:	2022-02-22T00:00:00
db:	VULMON	id:	CVE-2022-20703	date:	2022-02-10T00:00:00
db:	JVNDB	id:	JVNDB-2022-004543	date:	2023-04-18T00:00:00
db:	CNNVD	id:	CNNVD-202202-164	date:	2022-02-03T00:00:00
db:	NVD	id:	CVE-2022-20703	date:	2022-02-10T18:15:09.197