Sep 25, 2025Ravie LakshmananVulnerability / Community Safety
Cisco has warned of a high-severity safety flaw in IOS Software program and IOS XE Software program that might permit a distant attacker to execute arbitrary code or set off a denial-of-service (DoS) situation beneath particular circumstances.
The corporate mentioned the vulnerability, CVE-2025-20352 (CVSS rating: 7.7), has been exploited within the wild, including it grew to become conscious of it “after native Administrator credentials have been compromised.”
The difficulty, per the networking tools main, is rooted within the Easy Community Administration Protocol (SNMP) subsystem, arising because of a stack overflow situation.
An authenticated, distant attacker might exploit the flaw by sending a crafted SNMP packet to an affected machine over IPv4 or IPv6 networks, leading to DoS if they’ve low privileges or arbitrary code execution as root if they’ve excessive privileges and in the end take management of the vulnerable system.
Nonetheless, Cisco famous that for this to occur, the next situations should be met –
To trigger the DoS, the attacker should have the SNMPv2c or earlier read-only neighborhood string or legitimate SNMPv3 person credentials
To execute code as the foundation person, the attacker should have the SNMPv1 or v2c read-only neighborhood string or legitimate SNMPv3 person credentials and administrative or privilege 15 credentials on the affected machine
The corporate mentioned the difficulty impacts all variations of SNMP, in addition to Meraki MS390 and Cisco Catalyst 9300 Collection Switches which are operating Meraki CS 17 and earlier. It has been mounted in Cisco IOS XE Software program Launch 17.15.4a. Cisco IOS XR Software program and NX-OS Software program usually are not impacted.
“This vulnerability impacts all variations of SNMP. All units which have SNMP enabled and haven’t explicitly excluded the affected object ID (OID) needs to be thought of susceptible,” Cisco mentioned.
Whereas there are not any workarounds that resolve CVE-2025-20352, one mitigation proposed by Cisco includes permitting solely trusted customers to have SNMP entry on an affected system, and monitoring the techniques by operating the “present snmp host” command.
“Directors can disable the affected OIDs on a tool,” it added. “Not all software program will assist the OID that’s listed within the mitigation. If the OID isn’t legitimate for particular software program, then it’s not affected by this vulnerability. Excluding these OIDs might have an effect on machine administration by SNMP, resembling discovery and {hardware} stock.”
