CVE-2023-20118 is a command injection vulnerability in Cisco Small Business RV Series Routers. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 March 2025, which means attackers have used it in real attacks. Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface.
What the vulnerability means in a network appliance
Command injection in a router management interface means an attacker can smuggle operating system commands through web inputs that were supposed to accept only normal administrative data. On internet-reachable appliances, that can turn a simple web request into device-level control.
For small-business routers, the danger is amplified because the management plane often sits close to the trust boundary for the whole network. If the web interface is exposed, a successful injection issue can become a direct path to configuration theft, traffic redirection, persistence, or broader internal access.
Why this class of flaw is dangerous
Injection bugs are dangerous because they collapse a defensive assumption: that the application layer will safely constrain what reaches the underlying operating system. When that assumption fails, the attacker does not just change a setting, they can often chain arbitrary system actions through the device itself.
That is especially consequential on edge appliances, where management features, VPN functions, routing, and logging all run on the same device. Guidance on edge device security treats exposed management interfaces and appliance hardening as first-order controls because compromise at the edge can affect every user behind it.
How organisations check exposure and confirm scope
Exposure review starts with a precise asset inventory: which Cisco Small Business RV Series Routers exist, where they are deployed, and whether the web-based management interface is reachable from untrusted networks. Teams should then compare those assets with the vendor advisory and the CISA KEV catalogue to confirm whether the issue is relevant to their environment.
For internet-facing appliances, the practical question is not only whether the device exists, but whether it is administratively reachable, centrally monitored, and still within support. The vulnerability management guide is useful here because it frames asset scoping, KEV prioritisation, remediation tracking, and verification as a single workflow rather than separate tasks.
Remediation, detection, and post-compromise review
The safest response is to follow the vendor’s remediation guidance and remove public exposure to the management interface until the issue is fixed. If a patch or firmware update cannot be applied immediately, compensating controls should reduce reachability and limit who can administer the appliance.
Detection should look for management requests that do not match normal admin behaviour, unexpected configuration changes, new accounts, altered DNS or routing settings, and signs that the router has been used as a launch point for other activity. Because command injection can produce hidden system changes, a post-patch review should also examine logs, startup scripts, scheduled tasks, and credentials or keys that may have been exposed on the device.
Risk and Threat Considerations
Internet-exposed router management interfaces are attractive because a single successful injection can yield high-value control over traffic, administrative settings, and sometimes adjacent credentials. Once the appliance is compromised, attackers may use it for persistence, traffic interception, or as a foothold into the internal network.
Failure mechanism: The web interface accepts unsafely handled input and passes it to the underlying system, allowing attacker-supplied commands to execute with appliance privileges.
Impact: The router can be repurposed to redirect traffic, expose internal services, weaken network trust boundaries, and support follow-on intrusion activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Command injection is prevented by validating and constraining management-interface input. |
| AC-6 — Least Privilege | Router administration should be limited to only the accounts and actions needed. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection and post-compromise review depend on reviewing appliance logs for malicious changes. | |
| Recommendation — Enforce SI-10 to block unsanitised management input from reaching operating-system commands. Apply AC-6 to restrict router administration to the minimum necessary privileges. Use AU-6 to review appliance logs for suspicious commands, configuration changes, and admin activity. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | The subject is an edge router whose secure administration and exposure management are central to the risk. |
| CIS-7 — Continuous Vulnerability Management | A KEV-listed router command-injection flaw requires prioritised exposure validation and remediation tracking. | |
| Recommendation — Apply CIS-12 to inventory, harden, and monitor router management exposure. Use CIS-7 to prioritise the router flaw, verify exposure, and track remediation to completion. | ||
| NIST CSF 2.0 | PR.PS-01 — Configuration Management | Secure router settings and management exposure are part of protecting the appliance configuration. |
| DE.CM-01 — Networks and Network Services Are Monitored | Monitoring network appliances helps detect abnormal management access and post-exploitation behaviour. | |
| Recommendation — Use PR.PS-01 to harden router configuration and remove unnecessary management exposure. Apply DE.CM-01 to monitor router activity for abnormal management and routing changes. | ||
Practitioner Guidance
Why practitioners should care: KEV-listed router flaws deserve fast treatment because edge appliances often sit outside the normal endpoint control stack, which makes compromise easy to miss and hard to contain. Treat exposure as a network-wide issue, not just a device problem.
What to watch for: Prioritise any device with remotely reachable management, weak administrative segmentation, or uncertain patch state. If you cannot prove the router is fixed and isolated, assume it needs immediate attention and validation.