Remote Code Execution in Cisco Small Business RV Series Routers (SSL VPN Module)

This repository contains a single Metasploit module targeting a stack buffer overflow vulnerability (CVE-2022-20699) in the SSL VPN functionality of Cisco RV340 routers (and potentially other RV series). The exploit is unauthenticated and works over the Internet, requiring only network access to the SSL VPN service (default port 8443, SSL enabled). The module crafts a custom ARMLE shellcode for a reverse TCP shell, as Metasploit does not natively support ARMLE encoders. The exploit is operational, providing a root shell if successful, though reliability is about 65% due to stack address variance. The code includes detection logic to verify the presence of the vulnerable service and uses direct TCP/SSL connections to deliver the payload. The repository is structured as a single Ruby file compatible with the Metasploit framework, and all exploit logic is contained within this file.

This repository contains a proof-of-concept exploit for CVE-2022-20699, targeting Cisco RV340 devices' SSLVPND service on port 8443. The main file, CVE-2022-20699.py, is a Python script that constructs a large payload (mostly filler bytes) and attempts to send it via an HTTPS POST request to the target device's /X endpoint. The script first checks if the SSLVPND service is up by attempting a TCP connection to port 8443. If the service is available, it repeatedly sends the crafted payload in an attempt to trigger remote code execution. However, the exploit does not include actual shellcode, so it serves as a proof-of-concept for the vulnerability rather than a fully weaponized exploit. The README provides a brief description and credits but no usage instructions. No hardcoded IPs or credentials are present; the target is supplied as a command-line argument.