Security News > 2022 > August > Cisco fixes critical remote code execution bug in VPN routers
Cisco has fixed critical security vulnerabilities affecting Small Business VPN routers and enabling unauthenticated, remote attackers to execute arbitrary code or commands and trigger denial of service conditions on vulnerable devices.
Successful exploitation of CVE-2022-20842 with crafted HTTP input could allow attackers "To execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition," the company explains.
The complete list of routers affected by these bugs includes Small Business RV160, RV260, RV340, and RV345 series VPN routers.
The company's Product Security Incident Response Team said Cisco is unaware of active exploitation or publicly available exploits in the wild.
Today, Cisco has also patched a third, high severity bug in the Open Plug and Play module of RV160, RV260, RV340, and RV345 series routers.
Last month, Cisco addressed another set of severe security bugs in the Cisco Nexus Dashboard data center management solution that let unauthenticated attackers execute commands and perform actions remotely with root or Administrator privileges.
News URL
Related news
- Critical Apache Avro SDK Flaw Allows Remote Code Execution in Java Applications (source)
- Critical Linux CUPS Printing System Flaws Could Allow Remote Command Execution (source)
- Critical Flaws in Tank Gauge Systems Expose Gas Stations to Remote Attacks (source)
- DrayTek fixed critical flaws in over 700,000 exposed routers (source)
- 700K+ DrayTek routers are sitting ducks on the internet, open to remote hijacking (source)
- CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches (source)
- Cisco fixes VPN DoS flaw discovered in password spray attacks (source)
- New Cisco ASA and FTD features block VPN brute-force password attacks (source)
- Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems (source)
- Critical vulnerability in Cisco industrial wireless access points fixed (CVE-2024-20418) (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-08-10 | CVE-2022-20842 | Improper Input Validation vulnerability in Cisco products Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. | 9.8 |