CVE-2020-3358: Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Denial of Service Vulnerability

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-16 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in the Secure Sockets Layer (SSL) VPN feature for Cisco Small Business RV VPN Routers could allow an unauthenticated, remote attacker to cause the device to unexpectedly restart, causing a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request over an SSL connection to the targeted device. A successful exploit could allow the attacker to cause a reload, resulting in a DoS condition.

Affected products

Cisco Rv340 Dual Wan Gigabit Vpn Router Firmware: before 1.0.03.18 — fixed in 1.0.03.18
Cisco Rv340W Dual Wan Gigabit Wireless-Ac Vpn Router Firmware: before 1.0.03.18 — fixed in 1.0.03.18
Cisco Rv345 Dual Wan Gigabit Vpn Router Firmware: before 1.0.03.18 — fixed in 1.0.03.18
Cisco Rv345P Dual Wan Gigabit Poe Vpn Router Firmware: before 1.0.03.18 — fixed in 1.0.03.18

How to fix

Upgrade to a fixed version: Cisco Rv340 Dual Wan Gigabit Vpn Router Firmware 1.0.03.18; Cisco Rv340W Dual Wan Gigabit Wireless-Ac Vpn Router Firmware 1.0.03.18; Cisco Rv345 Dual Wan Gigabit Vpn Router Firmware 1.0.03.18; Cisco Rv345P Dual Wan Gigabit Poe Vpn Router Firmware 1.0.03.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3358 or the next vulnerability affects your stack