Cisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-20352 | SNMP Stack Buffer Overflow in Cisco IOS and IOS XE Enables DoS and Root RCE Cisco IOS and IOS XE contain a stack-based buffer overflow (CWE-121) in the Simple Network Management Protocol (SNMP) subsystem. An attacker who can reach the device's SNMP service can send crafted SNMP requests: with a low-privileged SNMP account the attacker can crash the device and force a reload (denial of service), while with a high-privileged SNMP account the attacker can execute arbitrary code as root and take full control of the device. Any organization running Cisco IOS or IOS XE on routers, switches, or controllers is potentially affected, especially where SNMP is enabled or reachable from untrusted networks. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-29, confirming exploitation in the wild, and EPSS assigns it a 39.4% probability of exploitation within 30 days (99th percentile). CVSS scoring is not yet available and no public proof-of-concept is known, but defenders should treat the flaw as actively exploited. Do: Upgrade IOS and IOS XE devices to fixed software releases as specified in Cisco's security advisory; given the KEV listing, federal agencies should follow BOD 22-01 timelines or apply vendor-directed mitigations. As interim mitigation, restrict SNMP access to trusted management hosts using ACLs (and management VRFs where supported), disable SNMP on devices that do not need it, and audit existing SNMP community strings and SNMPv3 users to identify accounts with high privilege levels, which expose the root code-execution path. | 7.7 | 39% | KEV |
| massmillions of installed IOS/IOS XE devices worldwide, with likely hundreds of thousands internet-exposed where SNMP is reachable |
Full article367 words · extracted from helpnetsecurity.com · click to collapse
Cisco has fixed 14 vulnerabilities in IOS and IOS XE software, among them CVE-2025-20352, a high-severity vulnerability that has been exploited in zero-day attacks.
About CVE-2025-20352
Cisco IOS software can be found on older models of Cisco Catalyst switches, Integrated Services Routers, and small enterprise and branch routers, as well as many legacy platforms.
Cisco IOS XE software powers many of the company’s high-performance wireless controllers, routers and switches, including virtual routers and industrial networking devices.
CVE-2025-20352 is a stack overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE software. It can be triggered by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks.
“A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system,” the company explained.
“To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device.”
It seems that the attackers had the latter, as the Cisco PSIRT “became aware of successful exploitation of this vulnerability in the wild after local Administrator credentials were compromised.”
Update or mitigate
Cisco did not specify all the vulnerable IOS and IOS XE software releases, but noted that Meraki MS390 and Cisco Catalyst 9300 Series Switches running Meraki CS 17 and earlier are also affected.
Customers have been advised to use the Cisco Software Checker or a form in the security advisory to check whether their devices are running an affected version.
If the result they get is positive, they can upgrade to a specified fixed version. If that’s not immediately possible, Cisco has also shared a temporary mitigation: Administrators should allow only trusted users to have SNMP access on an affected system.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/09/25/cisco-ios-xe-cve-2025-20352/