As many as 2 million Cisco devices affected by actively exploited 0
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-20352 | SNMP Stack Buffer Overflow in Cisco IOS and IOS XE Enables DoS and Root RCE Cisco IOS and IOS XE contain a stack-based buffer overflow (CWE-121) in the Simple Network Management Protocol (SNMP) subsystem. An attacker who can reach the device's SNMP service can send crafted SNMP requests: with a low-privileged SNMP account the attacker can crash the device and force a reload (denial of service), while with a high-privileged SNMP account the attacker can execute arbitrary code as root and take full control of the device. Any organization running Cisco IOS or IOS XE on routers, switches, or controllers is potentially affected, especially where SNMP is enabled or reachable from untrusted networks. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-29, confirming exploitation in the wild, and EPSS assigns it a 39.4% probability of exploitation within 30 days (99th percentile). CVSS scoring is not yet available and no public proof-of-concept is known, but defenders should treat the flaw as actively exploited. Do: Upgrade IOS and IOS XE devices to fixed software releases as specified in Cisco's security advisory; given the KEV listing, federal agencies should follow BOD 22-01 timelines or apply vendor-directed mitigations. As interim mitigation, restrict SNMP access to trusted management hosts using ACLs (and management VRFs where supported), disable SNMP on devices that do not need it, and audit existing SNMP community strings and SNMPv3 users to identify accounts with high privilege levels, which expose the root code-execution path. | 7.7 | 39% | KEV |
| massmillions of installed IOS/IOS XE devices worldwide, with likely hundreds of thousands internet-exposed where SNMP is reachable |
Full article263 words · extracted from arstechnica.com · click to collapse
As many as 2 million Cisco devices are susceptible to an actively exploited zero-day that can remotely crash or execute code on vulnerable systems.
Cisco said Wednesday that the vulnerability, tracked as CVE-2025-20352, was present in all supported versions of Cisco IOS and Cisco IOS XE, the operating system that powers a wide variety of the company’s networking devices. The vulnerability can be exploited by low-privileged users to create a denial-of-service attack or by higher-privileged users to execute code that runs with unfettered root privileges. It carries a severity rating of 7.7 out of a possible 10.
Exposing SNMP to the Internet? Yep
“The Cisco Product Security Incident Response Team (PSIRT) became aware of successful exploitation of this vulnerability in the wild after local Administrator credentials were compromised,” Wednesday’s advisory stated. “Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.”
The vulnerability is the result of a stack overflow bug in the IOS component that handles SNMP (simple network management protocol), which routers and other devices use to collect and handle information about devices inside a network. The vulnerability is exploited by sending crafted SNMP packets.
To execute malicious code, the remote attacker must have possession of read-only community string, an SNMP-specific form of authentication for accessing managed devices. Frequently, such strings ship with devices. Even when modified by an administrator, read-only community strings are often widely known inside an organization. The attacker would also require privileges on the vulnerable systems. With that, the attacker can obtain RCE (remote code execution) capabilities that run as root.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2025/09/as-many-as-2-million-cisco-devices-affected-by-actively-exploited-0-day/