Cisco RV Routers CVE-2023-20118: Unpatched, Botnet-Exploited
There is no patch and never will be, and at least two botnet operations have used this bug to take over these routers; any RV016, RV042, RV042G, RV082, RV320 or RV325 still in service should be replaced.
Must act: Anyone with a Cisco RV016, RV042, RV042G, RV082, RV320 or RV325 in a branch office, small business or remote site, above all if remote management is on.
Can relax: Networks with none of these six models; Cisco says the RV160, RV260, RV340 and RV345 families are not affected by this advisory.
- Inventory routers at every site, including remote and small offices, and flag the six affected RV models.
- Replace each affected router with a supported device; there is no firmware fix to wait for.
- Until replaced, disable remote management (Firewall > General) and block WAN access to TCP 443 and 60443 (Firewall > Access Rules).