Malwarehigh
New Rootkit Campaign Exploits Cisco SNMP Flaw to Gain Persistence
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-3881 | Unauthenticated RCE in Cisco IOS/IOS XE switches via malformed CMP Telnet options | 9.8 | 99% | KEVPoC | KEV |
| CVE-2025-20352 | SNMP Stack Buffer Overflow in Cisco IOS and IOS XE Enables DoS and Root RCE | 7.7 | 42% | KEV | KEV |
From the original article
2 min read at infosecurity-magazine.com
A campaign that exploited a Cisco Simple Network Management Protocol vulnerability to install Linux rootkits on exposed network devices has been observed. The exploit, tracked as CVE-2025-20352 and detailed in a new analysis by Trend Micro, allowed remote code execution and persistent, unauthorized access by embedding hooks into IOSd memory and creating a universal password based around the word “disco.”
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.