Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in 'Zero Disco' Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-3881 | Unauthenticated RCE in Cisco IOS/IOS XE switches via malformed CMP Telnet options CVE-2017-3881 is a critical (CVSS 9.8) unauthenticated remote code execution flaw, classified CWE-20, in the Cluster Management Protocol (CMP) processing code of Cisco IOS and IOS XE, which uses Telnet internally for signaling between switch cluster members. Because affected devices accept CMP-specific Telnet options on any inbound Telnet connection and mishandle malformed ones, an unauthenticated attacker who opens a Telnet session to a Telnet-enabled device and sends malformed CMP options can trigger the flaw. Successful exploitation lets the attacker execute arbitrary code with elevated privileges, gaining full control of the device, or force a reload of the switch. Affected hardware spans over 300 switching models per related coverage — Catalyst switches, Embedded Service 2020 and IE Industrial Ethernet switches, several EtherSwitch service modules, the ME 4924-10GE, RF Gateway 10, and the CGESM module for HP — running IOS or IOS XE with Telnet enabled; devices that accept only SSH are not remotely exploitable. The bug was disclosed via the March 2017 WikiLeaks Vault 7 CIA leak (tied to the 'Zero Disco' toolkit in related coverage), patched by Cisco that month, has a public PoC (Exploit-DB 41872), was added to CISA's KEV on 2022-03-25 (ransomware use unknown), and EPSS rates a 99% probability of exploitation in 30 days (100th percentile), so in-the-wild exploitation should be assumed. Do: Upgrade affected switches to the fixed IOS/IOS XE releases listed in Cisco's advisory for bug CSCvd48893 (the CISA KEV required action is to apply the vendor updates). Until patched, disable Telnet on vty lines and use SSH, or restrict inbound TCP/23 to trusted management hosts, since the bug is only reachable via inbound Telnet sessions. Audit configurations for 'transport input telnet' and prioritize internet-facing or widely reachable Catalyst, IE industrial, and EtherSwitch-service-module devices. | 9.8 | 99% | KEV PoC |
| mass≈1M+ deployed affected switches across 300+ models (only the Telnet-enabled subset is exploitable, likely hundreds of thousands of exposed systems) | |
| CVE-2025-20352 | SNMP Stack Buffer Overflow in Cisco IOS and IOS XE Enables DoS and Root RCE Cisco IOS and IOS XE contain a stack-based buffer overflow (CWE-121) in the Simple Network Management Protocol (SNMP) subsystem. An attacker who can reach the device's SNMP service can send crafted SNMP requests: with a low-privileged SNMP account the attacker can crash the device and force a reload (denial of service), while with a high-privileged SNMP account the attacker can execute arbitrary code as root and take full control of the device. Any organization running Cisco IOS or IOS XE on routers, switches, or controllers is potentially affected, especially where SNMP is enabled or reachable from untrusted networks. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-29, confirming exploitation in the wild, and EPSS assigns it a 39.4% probability of exploitation within 30 days (99th percentile). CVSS scoring is not yet available and no public proof-of-concept is known, but defenders should treat the flaw as actively exploited. Do: Upgrade IOS and IOS XE devices to fixed software releases as specified in Cisco's security advisory; given the KEV listing, federal agencies should follow BOD 22-01 timelines or apply vendor-directed mitigations. As interim mitigation, restrict SNMP access to trusted management hosts using ACLs (and management VRFs where supported), disable SNMP on devices that do not need it, and audit existing SNMP community strings and SNMPv3 users to identify accounts with high privilege levels, which expose the root code-execution path. | 7.7 | 39% | KEV |
| massmillions of installed IOS/IOS XE devices worldwide, with likely hundreds of thousands internet-exposed where SNMP is reachable |
Full article477 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 16, 2025Vulnerability / Linux
Cybersecurity researchers have disclosed details of a new campaign that exploited a recently disclosed security flaw impacting Cisco IOS Software and IOS XE Software to deploy Linux rootkits on older, unprotected systems.
The activity, codenamed Operation Zero Disco by Trend Micro, involves the weaponization of CVE-2025-20352 (CVSS score: 7.7), a stack overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow an authenticated, remote attacker to execute arbitrary code by sending crafted SNMP packets to a susceptible device. The intrusions have not been attributed to any known threat actor or group.
The shortcoming was patched by Cisco late last month, but not before it was exploited as a zero-day in real-world attacks.
"The operation primarily impacted Cisco 9400, 9300, and legacy 3750G series devices, with additional attempts to exploit a modified Telnet vulnerability (based on CVE-2017-3881) to enable memory access," researchers Dove Chiu and Lucien Chuang said.
The cybersecurity company also noted that the rootkits allowed attackers to achieve remote code execution and gain persistent unauthorized access by setting universal passwords and installing hooks into the Cisco IOS daemon (IOSd) memory space. IOSd is run as a software process within the Linux kernel.
Another notable aspect of the attacks is that they singled out victims running older Linux systems that do not have endpoint detection response solutions enabled, making it possible to deploy the rootkits in order to fly under the radar. In addition, the adversary is said to have used spoofed IPs and Mac email addresses in their intrusions.
The rootkit is commandeered by means of a UDP controller component that that can serve as listener for incoming UDP packets on any port, toggle or disable log history, create a universal password by modifying IOSd memory, bypass AAA authentication, conceal certain portions of the running configuration, and hide changes made to the configuration by altering the timestamp to give the impression that it was never modified.
Besides CVE-2025-20352, the threat actors have also been observed attempting to exploit a Telnet vulnerability that is a modified version of CVE-2017-3881 so as to allow memory read/write at arbitrary addresses. However, the exact nature of the functionality remains unclear.
The name "Zero Disco" is a reference to the fact that the implanted rootkit sets a universal password that includes the word "disco" in it -- a one-letter change from "Cisco."
"The malware then installs several hooks onto the IOSd, which results in fileless components disappearing after a reboot," the researchers noted. "Newer switch models provide some protection via Address Space Layout Randomization (ASLR), which reduces the success rate of intrusion attempts; however, it should be noted that repeated attempts can still succeed."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/10/hackers-deploy-linux-rootkits-via-cisco.html