CVE-2023-20118: Cisco Small Business RV Series Router Firmware vulnerability

1. In CISA KEVCISA KEV catalogue3 Mar 2025
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not established: not seen

DescriptionCVE.org

A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device. Cisco has not and will not release software updates that address this vulnerability. However, administrators may disable the affected feature as described in the Workarounds ["#workarounds"] section. {{value}} ["%7b%7bvalue%7d%7d"])}]]

• Cisco · Cisco Small Business RV Series Router Firmware1.0.1.17; 1.0.2.03; 1.1.0.09; 1.1.1.19; 1.1.1.06; 1.2.1.13 and 12 more

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.

CISA KEV

Listed since 3 Mar 2025 · catalogue entry

Public check

No public nuclei template

Weakness

Command Injection · Command and Code Injection

Vendor

Cisco

Published

April 2023

Band

Exploited in the wild, April 2023

1. 3 Mar 2025
   CISA added it to the KEV catalogue CISA

• NVD entrynvd.nist.gov
• CISA KEV cataloguecisa.gov
• CVE recordcve.org
• Weakness CWE-77cwe.mitre.org
• sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvsec.cloudapps.cisco.com