CVE-2025-20352

What it actually does

The vulnerability is a stack overflow in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software. An authenticated remote attacker can trigger the flaw by sending crafted SNMP traffic over IPv4 or IPv6. With SNMPv2c or earlier read-only community access, or valid SNMPv3 credentials, an attacker can cause an affected device to reload, creating a denial-of-service condition. On Cisco IOS XE, an attacker who also has administrative or privilege 15 credentials can escalate the impact to arbitrary code execution as root, resulting in full control of the network device. Cisco notes that all SNMP versions are affected.

Why it matters to the business

Successful exploitation can interrupt routing, switching, firewall, wireless, or edge network services by forcing device reloads. In the higher-impact IOS XE scenario, compromise of a network device can allow an attacker to control traffic paths, modify configurations, disable security controls, intercept or redirect communications, and establish persistence in core infrastructure. This vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and the CISA remediation deadline of 2025-10-20 has passed, so exposed or unpatched devices should be treated as urgent remediation priorities.

How an attack unfolds

An attacker first obtains usable SNMP access, such as a read-only SNMPv1/v2c community string or valid SNMPv3 user credentials. The attacker identifies Cisco IOS or IOS XE devices reachable over UDP/161 on IPv4 or IPv6 and sends specially crafted SNMP packets to the SNMP service. On vulnerable devices, the malformed request triggers a stack overflow in the SNMP subsystem. With lower privilege SNMP access, the likely outcome is a device crash and reload, causing a denial of service. On vulnerable IOS XE devices where the attacker also has administrative or privilege 15 device credentials, exploitation can result in code execution as root and full device compromise. Public reporting and KEV status indicate active exploitation associated with campaigns tracking Cisco IOS/IOS XE SNMP exploitation, including Operation Zero Disco and broader September 2025 active exploitation activity.

How to fix it

Upgrade affected Cisco IOS and Cisco IOS XE devices to a Cisco-fixed software release using the Cisco advisory and Cisco Software Checker for the exact platform and train; no specific fixed versions were provided in the input. Because all SNMP versions are affected, changing from SNMPv1/v2c to SNMPv3 alone is not sufficient remediation, although SNMPv3 remains preferred for credential protection. If immediate upgrade is not possible, restrict SNMP access to trusted management hosts only using ACLs, infrastructure ACLs, control-plane policing, and management-plane segmentation; remove unused SNMP communities and users; rotate SNMP community strings and SNMPv3 credentials; disable SNMP where it is not required; and ensure administrative or privilege 15 credentials are rotated and protected with MFA where supported by the management workflow. Internet-exposed SNMP should be eliminated.

How to confirm the fix worked

Confirm the running software version against Cisco’s fixed-release guidance for the exact device model and software train. Verify that SNMP is disabled where unnecessary or limited to approved management sources only. Test from untrusted network segments to ensure UDP/161 and any SNMP-over-IPv6 exposure are blocked. Review the device configuration for SNMPv1/v2c communities, SNMPv3 users, permissive ACLs, and excessive administrative access. Confirm uptime and crash history are stable after patching, and verify that no unexpected reloads, crashinfo files, or SNMP-related exceptions appear after remediation. Where possible, use authenticated vulnerability scanning or configuration compliance checks rather than unauthenticated version inference alone.

Typical attack path

1. Obtain or discover SNMP credentials, such as an SNMPv1/v2c community string or SNMPv3 username and authentication material.
2. Scan for Cisco IOS or Cisco IOS XE devices reachable over UDP/161 via IPv4 or IPv6.
3. Confirm SNMP responds and identify device type, software family, and version where possible.
4. Send crafted SNMP packets designed to trigger the SNMP stack overflow.
5. Cause the target device to reload, producing a denial-of-service condition, or, on IOS XE with required administrative privileges, execute code as root.
6. If code execution is achieved, modify configuration, create persistence, pivot through the network, capture traffic, or impair network operations.

How to detect it

Investigate both denial-of-service and potential device-compromise indicators. Review Cisco device syslog, AAA logs, SNMP authentication logs, configuration archive/history, NetFlow/IPFIX, firewall logs, NMS logs, TACACS+/RADIUS logs, and crashinfo/core files. Look for SNMP requests to UDP/161 from sources that are not approved network management systems, especially immediately before reloads, crashes, high CPU, watchdog events, or SNMP subsystem errors. Check for SNMP activity over IPv6 as well as IPv4. For IOS XE devices, correlate SNMP activity with administrative or privilege 15 logins, configuration changes, file writes, unexpected processes, new local users, altered AAA/SNMP settings, unexpected outbound connections, or persistence-like changes. Because active exploitation has been reported, investigate unexplained reloads or crashinfo creation after publication, especially around campaigns associated with Cisco IOS/IOS XE SNMP exploitation and Operation Zero Disco. Preserve crashinfo files and logs before rebooting or upgrading where practical.

• UDP/161
• SNMPv1
• SNMPv2c
• SNMPv3
• %SNMP
• %SNMP-3-AUTHFAIL
• %SNMP-3-INPUT_QFULL_ERR
• snmpd
• bootflash:crashinfo_
• flash:crashinfo_
• crashinfo:
• System returned to ROM by
• Last reload reason
• Software-forced reload
• Critical software exception
• Traceback=
• %SYS-6-RELOAD
• %SYS-2-WATCHDOG
• %SYS-3-CPUHOG
• privilege 15

What your security team should do

• Treat this as urgent because it is in CISA KEV, has active exploitation reported, and the remediation due date has passed.
• Inventory all Cisco IOS and IOS XE devices, including routers, switches, wireless controllers, edge devices, and management VRFs with SNMP enabled.
• Prioritize patching or mitigation for devices reachable from the internet, partner networks, user networks, or other less-trusted segments.
• Use Cisco Software Checker and vendor advisories to identify the correct fixed release for each platform and software train.
• Restrict SNMP to dedicated network management systems only; block UDP/161 from all other sources over IPv4 and IPv6.
• Disable SNMP where not operationally required, and remove legacy SNMPv1/v2c communities where possible.
• Rotate SNMP community strings, SNMPv3 credentials, and administrative or privilege 15 credentials, especially if any were broadly shared or exposed.
• Review logs, NetFlow, crashinfo, and configuration history for signs of exploitation before and after remediation.
• Add monitoring for unusual SNMP traffic volume, SNMP requests from non-management hosts, unexpected reloads, and privilege 15 logins near SNMP activity.
• If compromise is suspected, preserve crashinfo and logs, isolate the management plane, collect forensic artifacts, and follow Cisco incident response guidance before rebuilding or replacing device software.