Cisco Warns of Actively Exploited SNMP Vulnerability Permitting RCE or DoS in IOS Software program

Sep 25, 2025Ravie LakshmananVulnerability / Community Safety

Cisco has warned of a high-severity safety flaw in IOS Software program and IOS XE Software program that would permit a distant attacker to execute arbitrary code or set off a denial-of-service (DoS) situation beneath particular circumstances.

The corporate mentioned the vulnerability, CVE-2025-20352 (CVSS rating: 7.7), has been exploited within the wild, including it turned conscious of it “after native Administrator credentials had been compromised.”

The problem, per the networking tools main, is rooted within the Easy Community Administration Protocol (SNMP) subsystem, arising on account of a stack overflow situation.

An authenticated, distant attacker might exploit the flaw by sending a crafted SNMP packet to an affected gadget over IPv4 or IPv6 networks, leading to DoS if they’ve low privileges or arbitrary code execution as root if they’ve excessive privileges and finally take management of the vulnerable system.

Nevertheless, Cisco famous that for this to occur, the next circumstances have to be met –

• To trigger the DoS, the attacker will need to have the SNMPv2c or earlier read-only neighborhood string or legitimate SNMPv3 consumer credentials
• To execute code as the basis consumer, the attacker will need to have the SNMPv1 or v2c read-only neighborhood string or legitimate SNMPv3 consumer credentials and administrative or privilege 15 credentials on the affected gadget

The corporate mentioned the problem impacts all variations of SNMP, in addition to Meraki MS390 and Cisco Catalyst 9300 Collection Switches which might be operating Meraki CS 17 and earlier. It has been mounted in Cisco IOS XE Software program Launch 17.15.4a. Cisco IOS XR Software program and NX-OS Software program aren’t impacted.

“This vulnerability impacts all variations of SNMP. All gadgets which have SNMP enabled and haven’t explicitly excluded the affected object ID (OID) must be thought-about weak,” Cisco mentioned.

Whereas there aren’t any workarounds that resolve CVE-2025-20352, one mitigation proposed by Cisco entails permitting solely trusted customers to have SNMP entry on an affected system, and monitoring the methods by operating the “present snmp host” command.

“Directors can disable the affected OIDs on a tool,” it added. “Not all software program will help the OID that’s listed within the mitigation. If the OID is just not legitimate for particular software program, then it’s not affected by this vulnerability. Excluding these OIDs might have an effect on gadget administration via SNMP, reminiscent of discovery and {hardware} stock.”