How do you patch or mitigate CVE-2023-20118 (Cisco Small Business RV Series Routers Command Injection)?

CISA’s required action for CVE-2023-20118 is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Cisco Small Business RV Series Routers in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What matters first when remediating CVE-2023-20118?

Start by confirming where the Cisco Small Business RV Series Routers are still deployed, because the remediation decision depends on whether you can actually apply the vendor instructions in each environment. For an internet-exposed router, the priority is to remove that exposure immediately if you cannot patch or apply the mitigation.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog as the authoritative references for the required action and any service-specific handling, then map those instructions to your asset inventory so nothing is missed.

How should you apply the fix or mitigation safely?

The practical sequence is simple: identify every affected device, validate its role and exposure, apply the vendor security update or documented mitigation, and then verify that the device is no longer reachable in the ways that made exploitation useful. On network appliances, partial remediation is often worse than no remediation if management interfaces or WAN exposure remain open.

If you need a broader emergency workflow for exploited edge-device issues, the Zero-Day and Exploited Vulnerabilities Guide and the Edge Device Security Guide both reinforce the operational sequence: scope the device estate, reduce exposure fast, then confirm that the mitigation actually changed the reachable attack surface.

What if you cannot patch yet, or need to check for compromise?

If the product cannot be fixed right away, treat it as a temporary exception only if you can genuinely bound the exposure. That usually means removing internet access, restricting management paths, or taking the device out of service rather than leaving it exposed and hoping that compensating controls hold.

Because CISA marks the issue for active exploitation handling, also review logs, configuration changes, and outbound traffic for signs that the router was already abused before mitigation. The fastest reliable check is not just whether the router is running, but whether it was reachable from untrusted networks and whether its configuration or forwarding rules changed unexpectedly.

Risk and Threat Considerations

An unmitigated command-injection flaw in an edge router can convert a perimeter device into a control point for traffic interception, configuration tampering, or broader network access. The danger is higher when the device is internet-facing or used as a small-business perimeter because attackers do not need a user session, only reachable management or service surfaces.

Failure mechanism: Command injection lets an attacker supply input that the device executes as system commands, which can bypass intended access controls and enable configuration changes, data exposure, or persistent footholds.

Impact: Exposed routers can become an entry point for lateral movement, traffic redirection, credential theft, or loss of network availability, especially when they are left online after mitigation is unavailable.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE-2023-20118 requires fast identification and remediation of exposed vulnerable devices.
Recommendation — Prioritise, remediate, and verify vulnerable routers before attackers can exploit them.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about patching or mitigating a known exploitable flaw on network equipment.
	CA-7 — Continuous Monitoring	Checking exposure and post-fix status requires ongoing monitoring of device reachability and behaviour.
Recommendation — Apply approved mitigations or patches and verify remediation on affected devices. Monitor edge-device exposure and confirm the flaw is no longer reachable.
OWASP ASVS	V13 — Configuration	Mitigation here depends on secure device configuration and disabling exposed management paths.
Recommendation — Harden configuration and remove unnecessary externally reachable interfaces.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This is a classic technical vulnerability management and remediation scenario.
Recommendation — Track, patch, or mitigate the router flaw under technical vulnerability management.

Practitioner Guidance

What to prioritise: Prioritise the devices that are both internet-exposed and business-critical, because those have the shortest time to abuse and the highest blast radius if compromised.

What to verify: Verify that the fix or mitigation actually removes the exploitable path, not just that the firmware changed. For this class of issue, test exposure from the outside and confirm that management access, remote administration, and unnecessary forwarding rules are no longer reachable.

Decision rule: If you cannot apply the vendor mitigation with confidence, remove the device from service or place it behind a stronger perimeter control until replacement is possible. Do not leave an exploitable edge router in production because it is “still functioning.”

Practitioner takeaway: For exploited router flaws, the right question is not whether the device still works, but whether it still presents an externally reachable execution path after remediation.