erroneo.us
Search all guides⌘K

Security Digest · Mar 14, 2023 · Vulnerability · Network edge

Cisco RV Routers CVE-2023-20118: Unpatched, Botnet-Exploited

End-of-life Cisco RV016/042/042G/082/320/325 routers have a root command injection Cisco will never fix; PolarEdge and ViciousTrap used it. Replace them.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Act now

There is no patch and never will be, and at least two botnet operations have used this bug to take over these routers; any RV016, RV042, RV042G, RV082, RV320 or RV325 still in service should be replaced.

Who must act: Anyone with a Cisco RV016, RV042, RV042G, RV082, RV320 or RV325 in a branch office, small business or remote site, above all if remote management is on.

Who can relax: Networks with none of these six models; Cisco says the RV160, RV260, RV340 and RV345 families are not affected by this advisory.

Affected
Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 routers, all firmware (end-of-life)
Fixed in
None; Cisco has not released and will not release a fix. Cisco recommends migrating to Meraki or Cisco 1000 Series Integrated Services Routers.
CVSS
6.5 (v3.1, CNA)
EPSS
54.1% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory routers at every site, including remote and small offices, and flag the six affected RV models.
  2. Replace each affected router with a supported device; there is no firmware fix to wait for.
  3. Until replaced, disable remote management (Firewall > General) and block WAN access to TCP 443 and 60443 (Firewall > Access Rules).
  4. Change the router admin password and any VPN pre-shared keys or accounts it holds, and restrict LAN access to the admin interface.
  5. Treat any affected router that had remote management exposed as possibly compromised and do not reuse its configuration on the replacement.

How to check if you are affected or compromised

  • Scan your public IPs with nmap -Pn -p 443,60443 to find RV management interfaces still exposed.
  • Search firewall or flow logs for traffic from the router to Sekoia's indicators, such as 119.8.186[.]227 and 195.123.212[.]54, or outbound FTP initiated by the router.
  • Look for unexpected TLS listeners on the router's WAN address and for new redirects of ports 80, 8000 or 8080.
  • Check for configuration changes, new admin users, or changed DNS and VPN settings.

What happened#

On March 14, 2023, Cisco added CVE-2023-20118 to an existing advisory for its Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 routers. The bug is a command injection in the web management interface. Input in incoming HTTP packets is not validated, so a crafted request can run commands with root privileges. Cisco says the attacker needs valid administrative credentials. As CNA, Cisco scores it CVSS 3.1 6.5 on the CVE record.

The key line is that Cisco "has not released and will not release" software updates. The routers are end-of-life. The same advisory covers CVE-2023-20025, an authentication bypass scored 9.0 on the RV016, RV042, RV042G and RV082. It is also unfixed, and Cisco knows of public exploit code for it.

In early 2025, two operations used CVE-2023-20118. Sekoia first saw it in its honeypots on January 22, 2025. The attackers hit the delete_cert function of /cgi-bin/config_mirror.exp. One case planted a webshell; another fetched a script over FTP that installed a TLS backdoor, cipher_log, persisted via /etc/flash/etc/cipher.sh. Sekoia named the botnet PolarEdge and counted 2,017 infected IPs worldwide. Its write-up describes the flaw as allowing unauthenticated command execution, which differs from Cisco's statement. In May 2025, Sekoia described ViciousTrap. That actor began exploiting the bug in March 2025 and used a script called NetGhost to redirect router ports to its own servers. It built a honeypot-like network of nearly 5,300 edge devices of many brands in 84 countries.

CISA added the CVE to the KEV catalog on March 3, 2025, with a March 24 deadline. On March 7, Cisco updated the advisory to say it knew of further attempted exploitation.

Who is affected#

All six models, on every firmware version. Cisco says the RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345 and RV345P are not affected by this advisory. It recommends moving to Meraki or Cisco 1000 Series Integrated Services Routers.

Do you really need to act?#

Yes, if you own one. Patching is not an option here. Cisco's mitigations (disable remote management, block TCP 443 and 60443 on the WAN) leave the LAN side open. The admin-login requirement is thin: the authentication bypass is unfixed on four models, and botnets reached these devices at scale. PolarEdge's purpose is still unclear, per reporting on Sekoia's findings. ViciousTrap could intercept traffic through the routers it held, as The Hacker News summarized. Either way, the router stops being yours.

What to do now#

  1. Inventory routers at every site and flag RV016, RV042, RV042G, RV082, RV320 and RV325 units.
  2. Replace them. There is no fix coming.
  3. Until then, turn off remote management under Firewall > General and block TCP 443 and 60443 on the WAN under Firewall > Access Rules.
  4. Change the admin password and any VPN keys or accounts the router holds.
  5. Build the replacement's configuration fresh. Do not import a backup from a router that may be compromised.

How to tell if you were hit#

  • Run nmap -Pn -p 443,60443 <public-range> to find exposed RV management interfaces.
  • Search firewall and flow logs for router traffic to Sekoia's indicators. These include the payload host 119.8.186[.]227, the PolarEdge C2 195.123.212[.]54 and the ViciousTrap source 101.99.91[.]151. Router-initiated FTP is also a red flag.
  • Look for unexpected TLS listeners on the WAN address, and for traffic on ports 80, 8000 or 8080 being forwarded off-site.
  • Any of these signs means the router is compromised. Replace it, and rotate credentials that crossed it.

Timeline#

  • — Cisco publishes the advisory for CVE-2023-20025 and CVE-2023-20026.
  • — Cisco adds CVE-2023-20118 and states that no fix will ship.
  • — Sekoia honeypots record the first PolarEdge exploitation.
  • — Sekoia publishes PolarEdge.
  • — CISA adds the CVE to KEV.
  • — Cisco notes further attempted exploitation.
  • — Sekoia publishes ViciousTrap.

Vulnerability records

  • CVE-2023-20118 · KEV 2025-03-03 · A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cisco — Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Vulnerabilities (cisco-sa-sbr042-multi-vuln-ej76Pke5) sec.cloudapps.cisco.com
  2. CVE record — CVE-2023-20118 cve.org
  3. CISA — Known Exploited Vulnerabilities: CVE-2023-20118 cisa.gov
  4. Sekoia — PolarEdge: Unveiling an uncovered IoT Botnet sekoia.com
  5. Sekoia — ViciousTrap: Infiltrate, Control, Lure. Turning edge devices into honeypots en masse sekoia.com

Coverage and analysis

  1. The Hacker News — PolarEdge Botnet Exploits Cisco and Other Flaws to Hijack ASUS, QNAP, and Synology Devices thehackernews.com
  2. The Hacker News — ViciousTrap Uses Cisco Flaw to Build Global Honeypot from 5,300 Compromised Devices thehackernews.com