Is the Cisco RV260 still getting security updates?
The Cisco RV260 stopped receiving security updates on 15 September 2022. New vulnerabilities will not be fixed.
The date after which a device gets no more security fixes is also called its end of life (EOL) or end of support.
Security updates ended on
15 September 2022What to do. Attackers are using known flaws in this model. Replace it. Until then, turn off remote administration and UPnP, and keep it off the Internet.
Vulnerabilities attackers are using
The U.S. cybersecurity agency (CISA) lists these vulnerabilities as actively exploited. Its description names the affected hardware versions when they are known.
- CVE-2022-20699: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
- CVE-2022-20700: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
- CVE-2022-20701: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
- CVE-2022-20703: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
- CVE-2022-20708: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Support timeline
Questions
Is the Cisco RV260 still getting security updates?
The Cisco RV260 stopped receiving security updates on 15 September 2022. New vulnerabilities will not be fixed.
Is the Cisco RV260 affected by vulnerabilities attackers are using?
Yes. The CISA catalogue of exploited vulnerabilities lists CVE-2022-20699, CVE-2022-20700, CVE-2022-20701, CVE-2022-20703, CVE-2022-20708 for this model. Check the affected hardware versions and install the latest firmware, or replace the device if it is no longer supported.
What does end of life mean for the Cisco RV260?
After its end of life, the Cisco RV260 receives no more security fixes from Cisco. It keeps working, but any vulnerability found later stays open, which makes it an easy target once attackers know about it.
Where does this date come from?
From the manufacturer: End-of-Sale and End-of-Life Announcement for the Cisco RV 160, RV260, RV345P, RV340W, RV260W, RV260P and RV160W VPN Router. Each date is shown exactly as published.
Other Cisco routers
- Meraki Go GX20ended 20 June 2026 Unsupported
- Meraki Go GX50ends 29 April 2027 Ending soon
- RV160ended 15 September 2022 Unsupported
- RV160Wended 15 September 2022 Unsupported
- RV260Pended 15 September 2022 Unsupported
- RV260Wended 15 September 2022 Unsupported
- RV340ended 28 October 2022 Unsupported
- RV340Wended 15 September 2022 Unsupported
- RV345ended 28 October 2022 Unsupported
- RV345Pended 15 September 2022 Unsupported