A serious vulnerability in Cisco IOS and IOS XE is under active attack, prompting the company to urge immediate software updates.
Quick Summary – TLDR:
- Cisco has confirmed active exploitation of a critical zero-day vulnerability in its IOS and IOS XE software.
- The flaw, tracked as CVE-2025-20352, resides in the SNMP subsystem, affecting all devices with SNMP enabled.
- Remote code execution and denial-of-service attacks are both possible, depending on the attacker’s privilege level.
- No workaround exists. Cisco urges users to upgrade immediately and limit SNMP access to trusted sources.
What Happened?
Cisco disclosed a high-severity zero-day vulnerability in its widely used networking software platforms, IOS and IOS XE, that attackers are actively exploiting in the wild. The flaw, identified as CVE-2025-20352, allows attackers to launch remote code execution (RCE) or denial-of-service (DoS) attacks based on their access level.
Cisco has already released security updates and is strongly recommending customers upgrade to patched versions immediately.
0-Day Alert 🚨
— Defused (@DefusedCyber) September 24, 2025
Actor exploiting Cisco IOS / XE zero-day (CVE-2025-20352)O. Patches are available now.
Our Cisco IOS honeypot contains the SNMP service, making it viable to tracking this exploit!
👉https://t.co/GXFaqghsXI pic.twitter.com/7EvnMYEquc
The Flaw: SNMP Stack Overflow Exposed
At the center of the issue is a stack-based buffer overflow vulnerability found in the Simple Network Management Protocol (SNMP) subsystem. The flaw affects all devices with SNMP enabled, regardless of whether they use SNMPv1, v2c, or v3 protocols.
An attacker can exploit the vulnerability by sending specially crafted SNMP packets over either IPv4 or IPv6 networks. If successful:
- Low-privileged attackers can cause a DoS condition, forcing vulnerable systems to reboot.
- High-privileged attackers, especially those with administrative or privilege 15 credentials, can execute arbitrary code as the root user, gaining full control over the device.
Cisco confirmed the flaw has been actively exploited following the compromise of local administrator credentials. The Product Security Incident Response Team (PSIRT) discovered the issue while investigating a support case, underscoring the real-world risk.
Broad Device Impact Across Cisco Products
The vulnerability impacts a wide range of Cisco devices running vulnerable IOS and IOS XE versions. This includes:
- Meraki MS390 switches
- Cisco Catalyst 9300 Series switches running Meraki CS 17 and earlier versions
All devices with SNMP enabled are considered vulnerable unless explicitly configured to exclude the affected Object Identifier (OID).
Admins can check for SNMP exposure using the following CLI commands:
- show running-config (look for snmp-server community)
- show running-config include snmp-server group
- show snmp user
No Workarounds, Only Mitigations
Cisco emphasized there are no full workarounds to patch this vulnerability. However, temporary mitigations include:
- Disabling vulnerable OIDs
- Restricting SNMP access to trusted IP addresses
- Monitoring SNMP hosts via
show snmp hostcommand
The vulnerability is rated 7.7 out of 10 on the CVSS scale, labeled High severity, and categorized under CWE-121: Stack-Based Buffer Overflow.
Additional Vulnerabilities Also Patched
Alongside CVE-2025-20352, Cisco patched 13 other vulnerabilities in this cycle. Two notable ones include:
- CVE-2025-20240: A reflected cross-site scripting (XSS) issue in IOS XE, exploitable by unauthenticated users to steal cookies.
- CVE-2025-20149: A local DoS vulnerability, allowing authenticated users to force device reloads.
This follows an earlier maximum-severity flaw in May, where a hardcoded JSON Web Token (JWT) allowed unauthenticated access to Wireless LAN Controllers.
SQ Magazine’s Takeaway
Let me be blunt. If you’re running Cisco devices and haven’t patched yet, you’re inviting trouble. This is not a theoretical flaw or a proof-of-concept demo. This zero-day is out in the wild and being used against real systems right now. I find it especially alarming that attackers can go from low privilege to full root access, depending on their credentials. The fact that Cisco is pushing immediate upgrades with no workaround says it all. If you manage any Cisco hardware, now is the time to act. Don’t wait for something to break.
