DaystoPatch

CiscoExploited incident

Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers remote command execution (end of life, no fix)

CVE-2023-20118Medium, CVSS 6.5In CISA's Known Exploited Vulnerabilities catalog since 3 Mar 2025

  • Exploited before a fix
  • End of life: vendor advises replacement
End of lifeEnd-of-life product. Cisco advises replacing it and plans no fix, so it is not on the live board.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
no fix planned
First public report to first fix
Follow-through
no fix planned
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco CSAF for cisco-sa-sbr042-multi-vuln-ej76Pke5, revision 2.0.0CuratedQuote verified

    Updated existing vulnerabilities to add hardware platforms and added CVE-2023-20118.

    CSAF revision 2.0.0 is dated 2023-03-14T15:39:17+00:00 (seconds dropped). The advisory was first published 2023-01-11 for CVE-2023-20025/20026; CVE-2023-20118 was added in this revision, which is its first public disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f5d39e93ecd79167…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    CVE.org record CVE-2023-20118ClaimedQuote verified5 Apr 2023, 16:05 UTC

    A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:71fbdb4ec05e83f2…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Feb 2025, 13:34 UTC

    Discover PolarEdge, a newly identified botnet targeting edge devices via CVE-2023-20118, using a stealthy TLS backdoor.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2023-20118)ClaimedQuote verified3 Mar 2025

    Cisco Small Business RV Series Routers Command Injection Vulnerability

    Added to CISA's KEV catalog on 2025-03-03.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco CSAF for cisco-sa-sbr042-multi-vuln-ej76Pke5, revision 2.0.0CuratedQuote verified

    Updated existing vulnerabilities to add hardware platforms and added CVE-2023-20118.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f5d39e93ecd79167…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    at disclosure

    Cisco PSIRT advisory cisco-sa-sbr042-multi-vuln-ej76Pke5CuratedQuote verified

    However, administrators can mitigate the vulnerabilities by disabling remote management and blocking access to ports 443 and 60443.

    Mitigation in the Workarounds section; assumed present since CVE-2023-20118 was added in revision 2.0 (the only later revision, 2.1 on 2025-03-07, changed only the exploitation section). No 2023 snapshot was checked.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5dc57c9267b34d10…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    No fixed release found yet for any affected branch.

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

This advisory changed after publication

  1. cisco-sa-sbr042-multi-vuln-ej76Pke5

    Recorded in the revision history

    Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Vulnerabilities

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 18 Dec 2024, 12:44 UTC: archived copyLater version captured 7 Mar 2025, 18:47 UTC: archived copyRecovered from archived copiesSnapshots 613d1db684… and 04516973eb…Incident page

Send this to your boss

Exploited flaw in retired Cisco RV small-business routers will not be fixed

Attackers are exploiting a command-execution flaw in Cisco's end-of-life RV016/RV042/RV082/RV320/RV325 routers, and Cisco has said it will never release a fix.

In plain words

Some older Cisco small-business routers have a security flaw that attackers are actively using, and Cisco has said it will never fix it because the products are retired. The only safe long-term action is to replace these routers. Until then, their remote management must be switched off so they cannot be reached from the internet.

What happened and who is affected

What happened

In March 2023 Cisco added CVE-2023-20118 to an advisory for its Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 routers: an attacker with administrator credentials can send a crafted request to the web management interface and run commands as root. Cisco said it 'has not released and will not release software updates' because the routers have entered the end-of-life process. In March 2025 Cisco said it was aware of attempted exploitation in the wild, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 3 March 2025. Cisco's only mitigation is to disable remote management and block ports 443 and 60443.

Who is affected

All software releases on Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 routers.

CVE-2023-20118. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2023-20118/

Affected products

  • Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 routers (all software releases)
How we built this timeline

END OF LIFE: the advisory's Fixed Software section says 'Cisco has not released and will not release software updates to address the vulnerabilities described in this advisory. Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers have entered the end-of-life process.' and the exploitation section says 'Cisco continues to strongly recommend that customers upgrade their hardware to Meraki or Cisco 1000 Series Integrated Services Routers'.

No patch moments exist. exploited before a fix=true because no patch has ever existed when exploitation was reported ('In March 2025, the Cisco PSIRT became aware of additional attempted exploitation of some of these vulnerabilities in the wild.'). Severity follows the CVSS base score 6.5 (Cisco SIR: Medium) for CVE-2023-20026/20118; the advisory header's 9.0 is for CVE-2023-20025, which is not in KEV.

Requires valid administrative credentials. Automated check: exposure over 365 days; needs human review.

Related

No related incidents.

Cisco report card