Cisco has warned of a high-severity security flaw in IOS Software program and IOS XE Software program that might permit a distant attacker to execute arbitrary code or set off a denial-of-service (DoS) situation beneath particular circumstances.
The corporate mentioned the vulnerability, CVE-2025-20352 (CVSS rating: 7.7), has been exploited within the wild, including it grew to become conscious of it “after native Administrator credentials had been compromised.”
The difficulty, per the networking tools main, is rooted within the Easy Community Administration Protocol (SNMP) subsystem, arising on account of a stack overflow situation.
An authenticated, distant attacker may exploit the flaw by sending a crafted SNMP packet to an affected gadget over IPv4 or IPv6 networks, leading to DoS if they’ve low privileges or arbitrary code execution as root if they’ve excessive privileges and finally take management of the vulnerable system.
Nonetheless, Cisco famous that for this to occur, the next circumstances must be met –
- To trigger the DoS, the attacker should have the SNMPv2c or earlier read-only neighborhood string or legitimate SNMPv3 person credentials
- To execute code as the basis person, the attacker should have the SNMPv1 or v2c read-only neighborhood string or legitimate SNMPv3 person credentials and administrative or privilege 15 credentials on the affected gadget
The corporate mentioned the difficulty impacts all variations of SNMP, in addition to Meraki MS390 and Cisco Catalyst 9300 Collection Switches which are working Meraki CS 17 and earlier. It has been fastened in Cisco IOS XE Software program Launch 17.15.4a. Cisco IOS XR Software program and NX-OS Software program should not impacted.
“This vulnerability impacts all variations of SNMP. All units which have SNMP enabled and haven’t explicitly excluded the affected object ID (OID) must be thought-about weak,” Cisco mentioned.
Whereas there are not any workarounds that resolve CVE-2025-20352, one mitigation proposed by Cisco includes permitting solely trusted customers to have SNMP entry on an affected system, and monitoring the methods by working the “present snmp host” command.
“Directors can disable the affected OIDs on a tool,” it added. “Not all software program will help the OID that’s listed within the mitigation. If the OID isn’t legitimate for particular software program, then it’s not affected by this vulnerability. Excluding these OIDs might have an effect on gadget administration via SNMP, comparable to discovery and {hardware} stock.”
