CVE-2022-20699 in cisco rv340 firmware
LogPulse has assessed this CVE and a detection rule is being built.
What the vulnerability is
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Affected software: cisco rv340 firmware, cisco rv340w firmware, cisco rv345 firmware, cisco rv345p firmware
Scores
- CVSS: 9.8 (critical)
- EPSS: 72.46% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-03-03
- Published: 2022-02-10
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Cisco RV340/RV340W/RV345/RV345P firmware to the fixed release (CVE-2022-20699)
Patch or upgrade. Installs the Cisco firmware release that fixes the stack-based buffer overflow in the SSL VPN module of RV340, RV340W, RV345 and RV345P routers. Cisco states there are no workarounds, so the firmware upgrade is the only fix.
Applies to: Cisco Small Business RV340, RV340W, RV345 and RV345P Dual WAN Gigabit VPN Routers on firmware before the first fixed release in the Cisco advisory, when acting as SSL VPN gateway (SSL VPN service on TCP 8443).
- List every Cisco RV340, RV340W, RV345 and RV345P router you run and note its firmware version (web UI: Status and Statistics, System Summary).
- Open the Cisco advisory cisco-sa-smb-mult-vuln-KA9PK6D and look up the first fixed firmware release for the RV34x series in its Fixed Software section.
- Download that release (or any later one) for the exact router model from Cisco Software Download (software.cisco.com).
- Back up the running configuration (Administration, Configuration Management).
- In the router web UI go to Administration, File Management, Manual Upgrade, choose Firmware Image, upload the downloaded file and start the upgrade; let the router reboot.
- After the reboot confirm the new firmware version on the System Summary page.
- Until the upgrade is done, if SSL VPN is not needed, turn off the SSL VPN gateway (VPN, SSL VPN) and block TCP 8443 from the internet on the WAN side; this removes the exposed attack surface but is not a vendor workaround.
- Because the flaw is in CISA KEV and was exploited, check routers that were exposed with SSL VPN on for signs of compromise (unknown admin accounts, changed configuration, unexpected outbound connections) and factory-reset and reconfigure any device you doubt.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.