Loading story…
Cisco disclosed a high-severity zero-day vulnerability, CVE-2025-20352, affecting the SNMP subsystem in IOS and IOS XE software, which is being actively exploited in the wild. The flaw, a stack-based buffer overflow, allows authenticated remote attackers with low privileges to cause denial-of-service conditions, while high-privileged attackers can achieve remote code execution as root on vulnerable IOS XE devices. Cisco confirmed that attackers have exploited this vulnerability after compromising local administrator credentials, highlighting the risk of credential theft and chained attacks. The vulnerability affects all devices with SNMP enabled, including Meraki MS390 and Cisco Catalyst 9300 Series Switches, and impacts all SNMP versions (v1, v2c, v3). Cisco has released security updates and strongly urges customers to upgrade immediately, as no workarounds exist beyond restricting SNMP access to trusted users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On 2025-09-26, Rockwell Automation published a product advisory noting the impact of Cisco's CVE-2025-20352 on Stratix-branded equipment. The notice extended the incident to downstream industrial networking products that incorporate affected Cisco technology.
On 2025-09-26, CERT-EU published an advisory on CVE-2025-20352, reiterating active exploitation and recommending immediate updates, assessment for compromise, and restricting SNMP access from untrusted networks. The advisory summarized Cisco's technical details, affected products, and available fixed release information.
On 2025-09-25, a public GitHub repository released an SNMP exposure checking tool for CVE-2025-20352 using onesixtyone and a parser. The tool provided defenders and researchers with practical assessment capability to identify potentially exposed Cisco IOS and IOS XE devices.
By 2025-09-25, external reporting highlighted the potential scale of exposure, estimating that as many as 2 million Cisco devices could be affected by the actively exploited zero-day. The estimate underscored the broad enterprise and service-provider risk posed by widespread SNMP use on IOS and IOS XE systems.
Subsequent reporting clarified that the vulnerability affects SNMP-enabled IOS and IOS XE devices across multiple product lines, including Meraki MS390 and Catalyst 9300 series running certain releases, while IOS XR and NX-OS are not affected. Reports also noted that all SNMP versions, including v1, v2c, and v3, are impacted.
At disclosure, Cisco released software updates for affected products, including IOS XE 17.15.4a, and advised customers to use its Software Checker to identify vulnerable versions. Cisco said there were no complete workarounds beyond patching, though restricting SNMP access to trusted networks or users could reduce exposure temporarily.
On 2025-09-24, Cisco disclosed CVE-2025-20352, a high-severity stack-based buffer overflow in the SNMP subsystem of IOS and IOS XE that was being actively exploited in the wild. The flaw can be triggered with crafted SNMP packets and may lead to denial of service or, with higher privileges, code execution as root.
18 references tracked. Mallory keeps watching after this page renders.
cert.europa.eu
Open sourcescworld.com
Open sourcerockwellautomation.com
Open sourcearstechnica.com
Open sourcethecyberthrone.in
Open sourcerunzero.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for 14 vulnerabilities in **Cisco IOS** and **Cisco IOS XE**, including the actively exploited zero-day **`CVE-2025-20352`**. The flaw is a stack overflow in the SNMP subsystem that can be triggered with crafted SNMP packets over IPv4 or IPv6. Cisco said a remote authenticated attacker can cause a denial of service, while an authenticated attacker with administrator privileges can escalate to remote code execution and full device compromise. Affected products include unpatched Cisco IOS and IOS XE devices, along with **Meraki MS390** and **Cisco Catalyst 9300 Series** switches running **Meraki CS 17 or earlier** when SNMP is enabled and vulnerable OIDs have not been explicitly disabled. Cisco urged organizations to use its **Software Checker** to identify exposure and apply fixes immediately; where patching is not yet possible, recommended mitigations include restricting SNMP access to trusted sources, disabling SNMP, or disabling vulnerable OIDs through device configuration.
Jul 24, 2026
A critical security vulnerability, CVE-2025-20352, has been identified in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE software, affecting a wide range of Cisco networking devices. This stack overflow flaw allows remote attackers with valid SNMP credentials to send specially crafted SNMP packets over IPv4 or IPv6, potentially causing denial-of-service (DoS) by forcing device reloads or, in more severe cases, enabling remote code execution as root. The vulnerability impacts all SNMP versions (v1, v2c, v3) and has been confirmed to affect both legacy and modern modular Cisco operating systems, including Meraki MS390 and Catalyst 9300 Series Switches running Meraki CS 17 and earlier. Reports indicate that up to 2 million devices globally, including those operated by ISPs and cloud providers, are potentially exposed to this vulnerability. The flaw was discovered during a Cisco Technical Assistance Center (TAC) support case and has already been exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 29th, 2025. The exploitation of this vulnerability represents a significant escalation, as attackers have demonstrated the ability to gain administrator-level credentials and full device compromise. Rockwell Automation has issued an advisory confirming that its Lifecycle Services, specifically the Industrial Data Center (IDC) with Cisco Switching (Generations 1–5), are affected by this vulnerability. Rockwell has provided guidance on corrected software versions and available workarounds to mitigate the risk. The vulnerability poses a substantial threat to the backbone of enterprise, industrial, and service provider networks, given the widespread deployment of affected Cisco devices. Cisco’s response to the incident was initiated only after evidence of active exploitation emerged, underscoring the urgency of patching and mitigation. Organizations are strongly advised to update to the corrected Cisco software versions as soon as possible and to implement any recommended workarounds to reduce exposure. The incident highlights the ongoing risks associated with SNMP-enabled network infrastructure and the importance of credential management and network segmentation. Security teams should prioritize the identification of vulnerable devices and monitor for signs of exploitation. The rapid exploitation and large attack surface associated with CVE-2025-20352 make it a high-priority threat for organizations relying on Cisco networking equipment.
Jun 29, 2026
Multiple vulnerabilities in **Cisco IOS** and **Cisco IOS XE** devices have exposed routers, switches, access points, and Catalyst 9000 platforms to severe compromise, including **remote code execution**, **denial of service**, **access control bypass**, **privilege escalation**, **secure boot bypass**, **cross-site scripting**, and memory corruption. Traficom highlighted newly disclosed flaws such as `CVE-2025-20334` and `CVE-2025-20363`, which may allow arbitrary code execution, and urged organizations to update affected products in line with Cisco’s version-specific advisories. The warning follows earlier real-world attacks against internet-exposed Cisco IOS XE Web GUI instances, where attackers exploited `CVE-2023-20198` and `CVE-2023-20273` to create unauthorized administrator accounts, install a backdoor implant, and seize full control of devices. Cisco Talos reported the campaign affected exposed systems internationally, with tens of thousands of vulnerable devices identified online, while Finnish authorities said some domestic devices had already been backdoored and advised restricting Web GUI access to trusted networks or removing public internet exposure entirely.
Jun 29, 2026