CVE:CVE-2022-20705
CNNVD:CNNVD-202202-166
Cisco Small Business是美国思科（Cisco）公司的一个交换机。
Cisco Small Business RV 系列路由器存在缓冲区错误漏洞，该漏洞源于会话标识符生成函数使用弱熵造成的。攻击者可以通过使用暴力破解来确定当前会话标识符，然后重用该标识符来接管正在进行的会话，或者通过制作新的有效会话标识符并绕过整个身份验证机制来利用此漏洞。成功的利用可能允许攻击者在 Web UI 中以最高管理用户级别的权限采取行动，并利用此通报中描述的其他漏洞发动进一步攻击。
solution:Upgrade cisco rv340_firmware to a higher version than 1.0.03.24,and avoid the version (,1.0.03.24]; Upgrade cisco rv340w_firmware to a higher version than 1.0.03.24,and avoid the version (,1.0.03.24]; Upgrade cisco rv345_firmware to a higher version than 1.0.03.24,and avoid the version (,1.0.03.24]; Upgrade cisco rv345p_firmware to a higher version than 1.0.03.24,and avoid the version (,1.0.03.24]; Upgrade cisco rv160_firmware to a higher version than 1.0.01.05,and avoid the version (,1.0.01.05]; Upgrade cisco rv160w_firmware to a higher version than 1.0.01.05,and avoid the version (,1.0.01.05]; Upgrade cisco rv260_firmware to a higher version than 1.0.01.05,and avoid the version (,1.0.01.05]; Upgrade cisco rv260p_firmware to a higher version than 1.0.01.05,and avoid the version (,1.0.01.05]; Upgrade cisco rv260w_firmware to a higher version than 1.0.01.05,and avoid the version (,1.0.01.05]