CVE-2022-20705: (Pwn2Own) Cisco RV340 NGINX sessionid Directory Traversal Authentication Bypass Vulnerability
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Other sources
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the NGINX web server. When parsing the sessionid cookie, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to bypass authentication on the system.
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the sessionid parameter provided to the upload.cgi endpoint. The issue results from the lack of proper validation of the user-supplied sessionid cookie. An attacker can leverage this vulnerability to bypass authentication on the system.
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Cisco RV340 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the NGINX web server. When parsing the Authorization request header, the server does not properly validate user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to create files in the context of the www-data user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-20705?
CVE-2022-20705 is a vulnerability that allows network-adjacent attackers to create arbitrary files on affected installations of Cisco RV340 routers.
How severe is CVE-2022-20705?
CVE-2022-20705 has a severity score of 9.8, which is considered critical.
How can CVE-2022-20705 be exploited?
To exploit CVE-2022-20705, authentication is required, but the existing authentication mechanism can be bypassed.
Which Cisco products are affected by CVE-2022-20705?
Cisco RV340 routers, Cisco Rv340 Firmware, Cisco Rv340w Firmware, Cisco Rv345 Firmware, Cisco Rv345p Firmware, Cisco Rv160 Firmware, Cisco Rv160w Firmware, Cisco Rv260 Firmware, Cisco Rv260p Firmware, and Cisco Rv260w Firmware are affected by CVE-2022-20705.
How can I fix CVE-2022-20705?
To fix CVE-2022-20705, update the affected Cisco RV340 routers and firmware to a version that addresses the vulnerability.