Operation Zero Disco: Threat actors targets Cisco SNMP flaw to drop Linux rootkits
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-3881 | Unauthenticated RCE in Cisco IOS/IOS XE switches via malformed CMP Telnet options CVE-2017-3881 is a critical (CVSS 9.8) unauthenticated remote code execution flaw, classified CWE-20, in the Cluster Management Protocol (CMP) processing code of Cisco IOS and IOS XE, which uses Telnet internally for signaling between switch cluster members. Because affected devices accept CMP-specific Telnet options on any inbound Telnet connection and mishandle malformed ones, an unauthenticated attacker who opens a Telnet session to a Telnet-enabled device and sends malformed CMP options can trigger the flaw. Successful exploitation lets the attacker execute arbitrary code with elevated privileges, gaining full control of the device, or force a reload of the switch. Affected hardware spans over 300 switching models per related coverage — Catalyst switches, Embedded Service 2020 and IE Industrial Ethernet switches, several EtherSwitch service modules, the ME 4924-10GE, RF Gateway 10, and the CGESM module for HP — running IOS or IOS XE with Telnet enabled; devices that accept only SSH are not remotely exploitable. The bug was disclosed via the March 2017 WikiLeaks Vault 7 CIA leak (tied to the 'Zero Disco' toolkit in related coverage), patched by Cisco that month, has a public PoC (Exploit-DB 41872), was added to CISA's KEV on 2022-03-25 (ransomware use unknown), and EPSS rates a 99% probability of exploitation in 30 days (100th percentile), so in-the-wild exploitation should be assumed. Do: Upgrade affected switches to the fixed IOS/IOS XE releases listed in Cisco's advisory for bug CSCvd48893 (the CISA KEV required action is to apply the vendor updates). Until patched, disable Telnet on vty lines and use SSH, or restrict inbound TCP/23 to trusted management hosts, since the bug is only reachable via inbound Telnet sessions. Audit configurations for 'transport input telnet' and prioritize internet-facing or widely reachable Catalyst, IE industrial, and EtherSwitch-service-module devices. | 9.8 | 99% | KEV PoC |
| mass≈1M+ deployed affected switches across 300+ models (only the Telnet-enabled subset is exploitable, likely hundreds of thousands of exposed systems) | |
| CVE-2025-20352 | SNMP Stack Buffer Overflow in Cisco IOS and IOS XE Enables DoS and Root RCE Cisco IOS and IOS XE contain a stack-based buffer overflow (CWE-121) in the Simple Network Management Protocol (SNMP) subsystem. An attacker who can reach the device's SNMP service can send crafted SNMP requests: with a low-privileged SNMP account the attacker can crash the device and force a reload (denial of service), while with a high-privileged SNMP account the attacker can execute arbitrary code as root and take full control of the device. Any organization running Cisco IOS or IOS XE on routers, switches, or controllers is potentially affected, especially where SNMP is enabled or reachable from untrusted networks. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-29, confirming exploitation in the wild, and EPSS assigns it a 39.4% probability of exploitation within 30 days (99th percentile). CVSS scoring is not yet available and no public proof-of-concept is known, but defenders should treat the flaw as actively exploited. Do: Upgrade IOS and IOS XE devices to fixed software releases as specified in Cisco's security advisory; given the KEV listing, federal agencies should follow BOD 22-01 timelines or apply vendor-directed mitigations. As interim mitigation, restrict SNMP access to trusted management hosts using ACLs (and management VRFs where supported), disable SNMP on devices that do not need it, and audit existing SNMP community strings and SNMPv3 users to identify accounts with high privilege levels, which expose the root code-execution path. | 7.7 | 39% | KEV |
| massmillions of installed IOS/IOS XE devices worldwide, with likely hundreds of thousands internet-exposed where SNMP is reachable |
Full article595 words · extracted from securityaffairs.com · click to collapse
Hackers exploit Cisco SNMP flaw CVE-2025-20352 in “Zero Disco” attacks to deploy Linux rootkits on outdated systems, researchers report.
Trend Micro researchers disclosed details of a new campaign, tracked as Operation Zero Disco, that exploited a recently disclosed security flaw impacting Cisco IOS Software and IOS XE Software to deploy Linux rootkits on older, unprotected systems.
The vulnerability, tracked as CVE-2025-20352 (CVSS score: 7.7), impacts Cisco IOS and IOS XE Software. The high-severity vulnerability resides in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and IOS XE Software.
The flaw allows remote authenticated attackers to trigger a DoS condition with low privileges or achieve root code execution with high privileges. An attacker could exploit the flaw by sending a crafted SNMP packet to a vulnerable device over IPv4 or IPv6 networks. The root cause of this vulnerability is a stack overflow condition in the SNMP subsystem of the affected software. The vulnerability impacts all devices with SNMP enabled.
The company’s Product Security Incident Response Team (PSIRT) is aware of attacks in the wild exploiting this vulnerability.
Operation Zero Disco mainly targeted Cisco 9400, 9300, and legacy 3750G devices, also attempting to exploit a modified Telnet flaw (from CVE-2017-3881) for memory access. The campaign focused on older Linux systems lacking EDR protection, deploying rootkits to conceal malicious activity and evade detection.
“Trend investigation revealed that once a Cisco device has a rootkit implanted, the malware sets a universal password that includes the word “disco” in it, which Trend Research believes is a one-letter change from Cisco. The malware then installs several hooks onto the IOSd, which results in fileless components disappearing after a reboot.” reads the report published by Trend Micro. “Newer switch models provide some protection via Address Space Layout Randomization (ASLR) which reduces the success rate of intrusion attempts; however, it should be noted that repeated attempts can still succeed.”
Trend Micro’s investigation recovered multiple exploits used in the campaign against Cisco devices (32- and 64-bit). Threat actors abused SNMP exploits to install rootkits (fileless backdoors on 64-bit builds), and used a Telnet exploit to enable arbitrary memory read/write. Attackers used an UDP controller and an ARP spoofing tool to run the implants. They could delete logs, hide changes, bypass access controls, enable a backdoor password, keeping attackers hidden and persistent.
Attackers target core switches in a segmented network protected by external and internal firewalls. They exploit default public SNMP on switches to gain privileged access. With switch access they add routing rules to reach other VLANs. They then impersonate a waystation IP to bypass the internal firewall. To do this, attackers disable switch logging, assign the waystation IP to a core-port, and run an ARP-spoofing tool from the Cisco shell. The real waystation goes offline from the IP conflict. Once inside the protected zone, they restore switch settings and re-enable logs to hide their activity. Real incidents often follow the same pattern but with greater complexity.
Upon installing the rootkit, attackers gain remote control and link two VLANs to move laterally. It opens a UDP listener on any port/IP (the port need not be open) to receive commands. The rootkit injects a volatile universal password into IOSd memory that works across authentication methods until reboot. It can hide accounts, EEM scripts, and ACLs from the running config, bypass VTY ACLs, disable or erase logs, and reset the last config-write timestamp to cover changes.
Trend Micro published Indicators of Compromise (IoCs) here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Zero Disco)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/183508/malware/operation-zero-disco-threat-actors-targets-cisco-snmp-flaw-to-drop-linux-rootkits.html