Command Execution Vulnerability in Cisco Small Business Routers
CVE-2023-20118

7.2HIGH

Key Information:

Vendor: Cisco
Status: Cisco Small Business Rv Series Router Firmware
Vendor: CVE Published:; 13 April 2023

Badges

💰 Ransomware👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2023-20118?

CVE-2023-20118 is a command execution vulnerability affecting Cisco Small Business Routers, specifically models RV016, RV042, RV042G, RV082, RV320, and RV325. This vulnerability arises from inadequate validation of user input within the web-based management interface of these routers. An authenticated remote attacker can exploit this flaw by sending a specially crafted HTTP request, which could allow them to execute arbitrary commands on the device. Successfully exploiting this vulnerability grants the attacker root-level access, potentially leading to unauthorized data access and manipulation of network configurations. The lack of forthcoming software updates from Cisco further exacerbates the risk, leaving organizations to rely on workarounds for mitigation.

Potential impact of CVE-2023-20118

Unauthorized Access: An attacker with valid administrative credentials can exploit this vulnerability to gain unauthorized access, potentially compromising sensitive information and configurations.
Network Disruption: The ability to execute arbitrary commands may allow attackers to manipulate router settings or disrupt network services, leading to downtime and operational disruptions for affected organizations.
Data Breaches: Gaining root-level privileges could facilitate data exfiltration or unauthorized modifications, resulting in critical data breaches that have significant legal and reputational repercussions for organizations affected.

CISA has reported CVE-2023-20118

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-20118 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.