CVE-2023-20118

Product

Cisco / Small Business RV Series Routers

Vulnerability

Cisco Small Business RV Series Routers Command Injection Vulnerability

Added to KEV

Mar 3, 2025

Remediate by

Mar 24, 2025

Known ransomware use

No

Summary description

Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5 ; https://nvd.nist.gov/vuln/detail/CVE-2023-20118