Cisco IOS/IOS XE SNMP Vulnerabilities Exploited in Ongoing Attacks, Warns CISA
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding critical vulnerabilities in Cisco's IOS and IOS XE Software SNMP subsystem, which are actively being exploited.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding critical vulnerabilities in Cisco's IOS and IOS XE Software SNMP subsystem, which are actively being exploited.
The vulnerability, identified as CVE-2025-20352, involves a stack-based buffer overflow in the Simple Network Management Protocol (SNMP) implementation. It has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Cisco disclosed CVE-2025-20352 on September 17, 2025. It describes how a malformed SNMP packet could trigger a stack-based buffer overflow in affected versions of IOS and IOS XE. Successful exploitation can result in denial-of-service (DoS) conditions or allow attackers to execute arbitrary code with root-level permissions. The vulnerability is classified under CWE-121: Stack-based Buffer Overflow.
Denial of Service: An unauthenticated attacker can send a specially crafted SNMP request to crash or reload the device, disrupting network availability. Remote Code Execution: A privileged attacker can execute arbitrary code as the root user, jeopardizing network infrastructure. Potential Lateral Movement: Attackers could pivot to internal resources, deploy additional malware, or exfiltrate sensitive data.
Evidence of exploitation has emerged, indicating that malicious actors are using automated tools to identify exposed SNMP endpoints. The widespread use of Cisco routers and switches in enterprise and service provider networks increases the risk profile.
The vulnerability, identified as CVE-2025-20352, involves a stack-based buffer overflow in the Simple Network Management Protocol (SNMP) implementation.
Cisco has released software updates to address the SNMP buffer overflow issues. Administrators should take the following actions:
Review the Cisco Security Advisory for CVE-2025-20352 to identify affected software versions. Download and install vendor-provided patches or software releases. If immediate patching is not possible, disable SNMP or restrict SNMP access through access control lists (ACLs) to trusted management hosts only. Monitor network devices for unusual SNMP traffic patterns indicating active exploitation attempts. Follow CISA’s Binding Operational Directive (BOD) 22-01 for endpoint protection and logging requirements.
If mitigation is impractical, such as with unsupported legacy hardware, discontinuing use or implementing robust compensating controls, including network segmentation and strict ACL enforcement, is advised.
Integrating the KEV catalog into a vulnerability management framework enhances visibility into critical threats. By aligning patch cycles and risk assessments with KEV entries, teams can prioritize high-impact vulnerabilities like CVE-2025-20352. Regular audits, applying the principle of least privilege, and maintaining up-to-date firmware are essential practices.
Effective incident response plans should include playbooks for DoS and RCE scenarios, with clear escalation paths to Cisco support and CISA resources. Collaboration between security operations, network engineering, and senior leadership is essential for rapid remediation.
Proactively updating devices, enforcing strict SNMP controls, and leveraging authoritative vulnerability intelligence will significantly reduce exposure to high-severity attacks.
Based on reporting by GBHackers.