Cisco RV016/RV042/RV042G/RV082/RV320/RV325 HTTP command injection

Summaryinfo

A vulnerability was found in Cisco RV016, RV042, RV042G, RV082, RV320 and RV325. It has been rated as critical. Impacted is an unknown function of the component HTTP Handler. Performing a manipulation results in an unknown weakness. This vulnerability was named CVE-2023-20118. The attack may be initiated remotely. In addition, an exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco RV016, RV042, RV042G, RV082, RV320 and RV325 (Router Operating System). This affects an unknown function of the component HTTP Handler. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device. Cisco has not and will not release software updates that address this vulnerability. However, administrators may disable the affected feature as described in the Workarounds ["#workarounds"] section. {{value}} ["%7b%7bvalue%7d%7d"])}]]

The weakness was presented 04/13/2023 as cisco-sa-sbr042-multi-vuln-ej76Pke5. The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2023-20118 since 10/27/2022. Technical details are unknown but an exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/28/2025). MITRE ATT&CK project uses the attack technique T1202 for this issue.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 03/03/2025 with a due date of 03/24/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• RV016
• RV042
• RV042G
• RV082
• RV320
• RV325

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion