CVE-2024-20470

highpriority · track · 29EPSS 0.006 · 49 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.62% (49th) EPSS

CVSS 7.2 · high

Is it mine?

113 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. In order to exploit this vulnerability, the attacker must have valid admin credentials. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP input to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco Small Business RV Series Router Firmwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technical severity, 0–10. One row per scoring source.

7.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.2 · impact 5.9

v3.17.2highAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondaryexploitability 1.2 · impact 5.2

v3.16.6mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-146USCWE-146USCWE-285US

affected products (113)

Products and version ranges known to be affected.

Cisco Small Business RV042all versionscert_bundDEcpe:/h:cisco:small_business:rv042
Cisco Small Business RV042Gall versionscert_bundDEcpe:/h:cisco:small_business:rv042g
Cisco Small Business RV320all versionscert_bundDEcpe:/h:cisco:small_business:rv320
Cisco Small Business RV325all versionscert_bundDEcpe:/h:cisco:small_business:rv325
Cisco Small Business RV340all versionscert_bundDEcpe:/h:cisco:small_business:rv340
Cisco Small Business RV340Wall versionscert_bundDEcpe:/h:cisco:small_business:rv340w
Cisco Small Business RV345all versionscert_bundDEcpe:/h:cisco:small_business:rv345
Cisco Small Business RV345Pall versionscert_bundDEcpe:/h:cisco:small_business:rv345p
Cisco Cisco Small Business RV Series Router Firmwareall versionscisco_csafUS
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.03.29enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.03.24enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.00.29enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.03.17enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.03.28enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.03.18enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.01.17enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.01.16enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.03.27enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.02.16enisa_euvdEU
Cisco Cisco Small Business RV Series Router Firmware≤ 1.0.01.20enisa_euvdEU

showing 20 of 113

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-3073Cisco Small Business: Mehrere Schwachstellen ermöglichen PrivilegieneskalationDeutsch2024-10-03csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cisco Small Business ausnutzen, um seine Privilegien zu erhöhen, beliebige Befehle auszuführen und einen Denial of Service-Zustand zu verursachen.
cisco-sa-rv34x-privesc-rce-qE33TCmsCisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Privilege Escalation and Remote Command Execution Vulnerabilities2024-10-02csaf · cisco_csafUS
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to elevate privileges and execute arbitrary commands on the underlying operating system of an affected device. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Cisco has not released and will not release software updates that address these vulnerabilities because the affected products are past their respective dates for End of Software Maintenance Releases. The Cisco Product Security Incident Response Team (PSIRT) will continue to evaluate and disclose security vulnerabilities that affect these products until they reach their respective Last Dates of Support. There are no workarounds that address these vulnerabilities.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisco_csaf NVD CVE.org MITRE

published 2024-10-02modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan