InfoSecBulletin Cybersecurity for mankind
Cisco has disclosed a zero-day vulnerability, CVE-2025-20352, in its popular IOS and IOS XE software, which is currently under active exploitation. The flaw in the Simple Network Management Protocol (SNMP) can let remote attackers execute code or cause denial-of-service (DoS) on affected devices.
The stack overflow vulnerability (CWE-121) exists in the SNMP subsystem of Cisco IOS and IOS XE software. An attacker can exploit this issue by sending a specially crafted SNMP packet to a vulnerable device on an IPv4 or IPv6 network.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The advisory, published on September 24, 2025, confirms that all versions of SNMP (v1, v2c, and v3) are susceptible.
Active Exploitation and Affected Devices:
Cisco’s Product Security Incident Response Team (PSIRT) has confirmed successful exploitation of this vulnerability in the wild. The advisory states that attackers exploited the flaw after first gaining local administrator credentials, showing a chained attack method. This highlights the critical need for strong credential management alongside patching.
Affected Products:
Vulnerable Products:
This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco IOS Software or Cisco IOS XE Software. Meraki MS390 and Cisco Catalyst 9300 Series Switches that are running Meraki CS 17 and earlier are also affected. This is fixed in Cisco IOS XE Software Release 17.15.4a.
Cisco has issued software updates to address this vulnerability and urges all customers to upgrade to fixed versions. The advisory, cisco-sa-snmp-x4LPhte, states that no workarounds exist.
Cisco offers a mitigation technique for organizations that can’t apply updates right away. Administrators can set up an SNMP view to exclude the affected object IDs (OIDs) to avoid triggering the vulnerable code.
However, Cisco cautions that this mitigation may disrupt network management functionalities, such as device discovery and hardware inventory monitoring. As a general security measure, Cisco also advises restricting SNMP access to only trusted users.
