InfoSecBulletin Cybersecurity for mankind
Cisco has disclosed a zero-day vulnerability, CVE-2025-20352, in its popular IOS and IOS XE software, which is currently under active exploitation. The flaw in the Simple Network Management Protocol (SNMP) can let remote attackers execute code or cause denial-of-service (DoS) on affected devices.
The stack overflow vulnerability (CWE-121) exists in the SNMP subsystem of Cisco IOS and IOS XE software. An attacker can exploit this issue by sending a specially crafted SNMP packet to a vulnerable device on an IPv4 or IPv6 network.
India asks WhatsApp not to roll out ‘username’ feature over fraud concerns
Azure CLI Password Spray Impacts 78 Microsoft Accounts in 81M+ Attempts
Chrome Update Patches 382 Vulnerabilities, Including 15 Critical
Apple fixes more than 30 iOS, macOS, and Safari flaws
Attackers exploit critical flaw in Oracle E-Business
WhatsApp to allow usernames instead of phone numbers
Linux Unveils New Open Source Security Project “Akrites” For (OSS) Ecosystem
Data breach affects 14.2 million email logins across six ISPs
Asian Two AI startups launch Mythos-like Model
Polymarket Hack Reportedly Results in $3 Million Theft
The advisory, published on September 24, 2025, confirms that all versions of SNMP (v1, v2c, and v3) are susceptible.
Active Exploitation and Affected Devices:
Cisco’s Product Security Incident Response Team (PSIRT) has confirmed successful exploitation of this vulnerability in the wild. The advisory states that attackers exploited the flaw after first gaining local administrator credentials, showing a chained attack method. This highlights the critical need for strong credential management alongside patching.
Affected Products:
Vulnerable Products:
This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco IOS Software or Cisco IOS XE Software. Meraki MS390 and Cisco Catalyst 9300 Series Switches that are running Meraki CS 17 and earlier are also affected. This is fixed in Cisco IOS XE Software Release 17.15.4a.
Cisco has issued software updates to address this vulnerability and urges all customers to upgrade to fixed versions. The advisory, cisco-sa-snmp-x4LPhte, states that no workarounds exist.
Cisco offers a mitigation technique for organizations that can’t apply updates right away. Administrators can set up an SNMP view to exclude the affected object IDs (OIDs) to avoid triggering the vulnerable code.
However, Cisco cautions that this mitigation may disrupt network management functionalities, such as device discovery and hardware inventory monitoring. As a general security measure, Cisco also advises restricting SNMP access to only trusted users.
