ID

VAR-202202-0326


CVE

CVE-2022-20702


TITLE

plural  Cisco Small Business RV  Series router out-of-bounds write vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-004938

DESCRIPTION

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory. plural Cisco Small Business RV Series routers contain an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of Cisco RV340 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the utility-ping-request script. The issue results from the creation of a temporary file with insecure permissions. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root

Trust: 2.34

sources: NVD: CVE-2022-20702 // JVNDB: JVNDB-2022-004938 // ZDI: ZDI-22-420 // VULMON: CVE-2022-20702

AFFECTED PRODUCTS

vendor:ciscomodel:rv160scope:lteversion:1.0.01.05

Trust: 1.0

vendor:ciscomodel:rv345pscope:lteversion:1.0.03.24

Trust: 1.0

vendor:ciscomodel:rv260scope:lteversion:1.0.01.05

Trust: 1.0

vendor:ciscomodel:rv340wscope:lteversion:1.0.03.24

Trust: 1.0

vendor:ciscomodel:rv345scope:lteversion:1.0.03.24

Trust: 1.0

vendor:ciscomodel:rv160wscope:lteversion:1.0.01.05

Trust: 1.0

vendor:ciscomodel:rv260wscope:lteversion:1.0.01.05

Trust: 1.0

vendor:ciscomodel:rv260pscope:lteversion:1.0.01.05

Trust: 1.0

vendor:ciscomodel:rv340scope:lteversion:1.0.03.24

Trust: 1.0

vendor:シスコシステムズmodel:rv260 vpn routerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:rv260p vpn router with poescope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:rv260w wireless-ac vpn routerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:rv160w wireless-ac vpn routerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:rv160 vpn routerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:rv345p dual wan gigabit poe vpn routerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:rv340 dual wan gigabit vpn routerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:rv340w dual wan gigabit wireless-ac vpn routerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:rv345 dual wan gigabit vpn routerscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv340scope: - version: -

Trust: 0.7

sources: ZDI: ZDI-22-420 // JVNDB: JVNDB-2022-004938 // NVD: CVE-2022-20702

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20702
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20702
value: CRITICAL

Trust: 1.0

NVD: CVE-2022-20702
value: HIGH

Trust: 0.8

ZDI: CVE-2022-20702
value: CRITICAL

Trust: 0.7

CNNVD: CNNVD-202202-163
value: HIGH

Trust: 0.6

VULMON: CVE-2022-20702
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-20702
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2022-20702
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20702
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2022-20702
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-20702
baseSeverity: CRITICAL
baseScore: 7.0
vectorString: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-420 // VULMON: CVE-2022-20702 // JVNDB: JVNDB-2022-004938 // CNNVD: CNNVD-202202-163 // NVD: CVE-2022-20702 // NVD: CVE-2022-20702

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-004938 // NVD: CVE-2022-20702

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-163

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202202-163

PATCH

title:cisco-sa-smb-mult-vuln-KA9PK6Durl:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Trust: 0.8

title:Cisco has issued an update to correct this vulnerability.url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Trust: 0.7

title:Cisco Small Business Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=183841

Trust: 0.6

title:Cisco: Cisco Small Business RV Series Routers Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-smb-mult-vuln-KA9PK6D

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: ZDI: ZDI-22-420 // VULMON: CVE-2022-20702 // JVNDB: JVNDB-2022-004938 // CNNVD: CNNVD-202202-163

EXTERNAL IDS

db:NVDid:CVE-2022-20702

Trust: 4.0

db:ZDIid:ZDI-22-420

Trust: 2.4

db:JVNDBid:JVNDB-2022-004938

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15946

Trust: 0.7

db:CS-HELPid:SB2022020301

Trust: 0.6

db:CNNVDid:CNNVD-202202-163

Trust: 0.6

db:VULMONid:CVE-2022-20702

Trust: 0.1

sources: ZDI: ZDI-22-420 // VULMON: CVE-2022-20702 // JVNDB: JVNDB-2022-004938 // CNNVD: CNNVD-202202-163 // NVD: CVE-2022-20702

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-smb-mult-vuln-ka9pk6d

Trust: 2.4

url:https://www.zerodayinitiative.com/advisories/zdi-22-420/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-20702

Trust: 1.4

url:https://www.cybersecurity-help.cz/vdb/sb2022020301

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/787.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

sources: ZDI: ZDI-22-420 // VULMON: CVE-2022-20702 // JVNDB: JVNDB-2022-004938 // CNNVD: CNNVD-202202-163 // NVD: CVE-2022-20702

CREDITS

Jeongun Baek of Diffense

Trust: 1.3

sources: ZDI: ZDI-22-420 // CNNVD: CNNVD-202202-163

SOURCES

db:ZDIid:ZDI-22-420
db:VULMONid:CVE-2022-20702
db:JVNDBid:JVNDB-2022-004938
db:CNNVDid:CNNVD-202202-163
db:NVDid:CVE-2022-20702

LAST UPDATE DATE

2024-08-14T13:53:35.891000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-420date:2022-02-22T00:00:00
db:VULMONid:CVE-2022-20702date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2022-004938date:2023-05-11T09:08:00
db:CNNVDid:CNNVD-202202-163date:2022-02-28T00:00:00
db:NVDid:CVE-2022-20702date:2023-11-07T03:42:40.140

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-420date:2022-02-22T00:00:00
db:VULMONid:CVE-2022-20702date:2022-02-10T00:00:00
db:JVNDBid:JVNDB-2022-004938date:2023-05-11T00:00:00
db:CNNVDid:CNNVD-202202-163date:2022-02-03T00:00:00
db:NVDid:CVE-2022-20702date:2022-02-10T18:15:09.137