Sourced tracker
Cisco Small Business router vulnerabilities exploited in the wild
9 Cisco Small Business flaws that CISA lists as actively exploited, with what Cisco Small Business says about each: the firmware that fixes it, or that the model is retired and will not be patched.
Exploited Cisco Small Business flaws, newest first
| Vulnerability | Added to KEV | Vendor status and models | Source |
|---|---|---|---|
| CVE-2023-20118Cisco Small Business RV Series Routers Command Injection Vulnerability | 3 Mar 2025 | Replace: no fixRV016, RV042, RV042G, RV082, RV320, RV325 | VendorRead 18 Oct 2026 |
| CVE-2019-15271Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability | 8 Jun 2022 | FixedRV042, RV042GFix: 4.2.3.10 Replace: no fixRV016, RV082 | VendorVendor 2Read 18 Oct 2026 |
| CVE-2022-20708Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 3 Mar 2022 | FixedRV340, RV340W, RV345, RV345PFix: 1.0.03.26 | VendorRead 18 Oct 2026 |
| CVE-2022-20703Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 3 Mar 2022 | FixedRV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, RV345PFix: RV160/RV260 1.0.01.07; RV340/RV345 1.0.03.26 | VendorRead 18 Oct 2026 |
| CVE-2022-20701Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 3 Mar 2022 | FixedRV340, RV340W, RV345, RV345PFix: 1.0.03.26 | VendorRead 18 Oct 2026 |
| CVE-2022-20700Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 3 Mar 2022 | FixedRV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, RV345PFix: RV160/RV260 1.0.01.07; RV340/RV345 1.0.03.26 | VendorRead 18 Oct 2026 |
| CVE-2022-20699Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 3 Mar 2022 | FixedRV340, RV340W, RV345, RV345PFix: 1.0.03.26 | VendorRead 18 Oct 2026 |
| CVE-2019-1652Cisco Small Business Routers Improper Input Validation Vulnerability | 3 Mar 2022 | FixedRV320, RV325Fix: 1.4.2.22 | VendorRead 18 Oct 2026 |
| CVE-2019-1653Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | 3 Nov 2021 | FixedRV320, RV325Fix: 1.4.2.22 | VendorRead 18 Oct 2026 |
Is your Cisco Small Business model still supported?
Cisco's end-of-sale and end-of-life notices for RV routers. RV320 and RV325 lost support on 31 Jan 2025.
Cisco Small Business end-of-life list Read 18 Oct 2026
What to do
- Find the model and hardware version on the label under the router.
- If the row says fixed, install that firmware or newer from Cisco Small Business’s own support site.
- If it says replace, the vendor will not patch it: a router exposed to the internet with a flaw attackers already use should be taken offline and replaced.
- Turn off remote management from the internet unless you need it.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. We copy CISA’s entry and re-check the catalog every week.
- The vendor status comes from the vendor’s own advisory or end-of-life notice, tied to a short sentence on that page that a script re-reads weekly.
- “Replace: no fix” means the vendor has said the model will not be patched. A router in that state stays open to the flaw for as long as it is online.
- Check the exact model and hardware version on the label under the router; vendors often fix one hardware version and retire another.
Other brands: ASUS · D-Link · DrayTek · MikroTik · NETGEAR · Tenda · TP-Link · Ubiquiti · Zyxel · All routers