Is CVE-2023-20118 (Cisco Small Business RV Series Routers Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-20118 to its Known Exploited Vulnerabilities catalogue on 3 March 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Any organisation running the affected product should treat remediation as urgent.

How to confirm whether the router fleet is exposed

The first step is to identify every Cisco Small Business RV Series Router in scope, then verify whether any instance still has the vulnerable web-based management interface reachable from the internet or broader internal networks. For an issue that is already known to be exploited, inventory and exposure checks matter as much as patch status, because unmanaged or forgotten appliances are often the ones that remain reachable longest.

That is why incident responders usually pair asset discovery with a vulnerability workflow such as Zero-Day and Exploited Vulnerabilities Guide and Edge Device Security Guide rather than treating this as a one-off patch event. Edge appliances are high-value targets because they often sit at trust boundaries and may be easier to overlook in normal endpoint tooling.

If you are validating exposure for a larger environment, treat the vendor advisory and the CISA KEV catalogue as the authoritative references for exact model applicability and remediation timing. The practical question is not only “is the CVE real?”, but “is any affected appliance still reachable, manageable, and in a state where an attacker could use the injection path?”

What remediation should look like when the issue is confirmed

When exploitation is already in the wild, the right response is to remove the vulnerable condition quickly, not to wait for a convenience window. That usually means applying the vendor fix or approved mitigation, restricting management-plane exposure, and confirming that the device is no longer accepting unauthenticated or weakly controlled web management requests from untrusted networks.

For edge devices, the operational mistake is to focus only on the CVE record and ignore the surrounding access path. A router can remain dangerous even after a partial change if remote administration, broad ACLs, or stale management accounts still provide an entry point that an injected command can abuse.

Use Vulnerability Management Guide to anchor the prioritisation logic: confirm scope, verify remediation, and track exceptions with an owner and expiry. If remediation cannot happen immediately, reduce exposure first by constraining management reachability and documenting the compensating control as a time-bound exception.

What to check if patching has to wait

If you cannot remediate immediately, assume the device may already have been probed or partially exploited. Command injection issues on network appliances often justify a compromise assessment, because attackers may use the first command to enumerate the environment, create persistence, or stage follow-on access without leaving obvious user-facing signs.

In practice, that means reviewing management logs, authentication history, configuration drift, outbound connections, and any unexpected administrative changes. For Cisco environments, the review should also consider whether the appliance sits in a role where it could have exposed credentials, routes, or other management-plane trust material after compromise.

Relevant incident patterns are well documented in Cisco DevHub breach 2024 and Salt Typhoon telecom intrusions 2025, which show how Cisco-related access paths can be used for lateral movement and persistence when an attacker gets a foothold. The lesson is to look for secondary impact, not just the original flaw.

Risk and Threat Considerations

Command injection on an internet-reachable router is high risk because it turns a management interface into an execution path. Once that path is reachable, an attacker may be able to run commands, alter configuration, weaken monitoring, or pivot deeper into the network without needing normal credentials.

Failure mechanism: The vulnerable web management interface accepts crafted input that the device interprets as operating-system commands, so a remote request can become arbitrary device action. That can lead to device takeover, configuration tampering, and attacker-controlled reconnaissance or persistence.

Impact: The router can become a beachhead rather than a perimeter control, exposing internal services, traffic flows, credentials, or remote administration paths that depend on the appliance remaining trustworthy.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes continuous vulnerability triage and remediation central.
Recommendation — Prioritise and remediate exposed routers using a tracked vulnerability management process.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Confirming exposure and finding affected appliances depends on vulnerability scanning and validation.
	SI-2 — Flaw Remediation	The question is about urgent remediation of an actively exploited software flaw.
Recommendation — Scan for affected appliances and validate remediation status before closing the finding. Apply the vendor fix or approved mitigation as soon as exposure is confirmed.
NIST CSF 2.0	PR.PS-01 — Identity Management, Authentication, and Access Control	Management-interface exposure on a router is an access-control problem at the trust boundary.
Recommendation — Restrict management access to the smallest trusted set of networks and admins.
MITRE ATT&CK	T1203 — Exploitation for Client Execution	Command injection is an exploitation path that turns crafted input into execution on the target.
Recommendation — Hunt for signs that the management interface was used to execute attacker-supplied commands.

Practitioner Guidance

What to verify: Confirm that every affected RV Series device is either remediated or isolated from any network path that can reach its management interface. If a device is still internet-facing, treat that as an active exposure until proven otherwise.

Escalation / exception: Escalate immediately if the device supports business-critical traffic, because that is exactly when teams are tempted to defer action and accept unmanaged exposure. A short maintenance delay may be acceptable only if compensating controls are explicit, time-boxed, and reviewed by the owner.

Practitioner takeaway: For an actively exploited router flaw, the real decision is whether you have removed attacker reachability, not whether you have simply noted the CVE in a ticket.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org