Cisco has warned of a high-severity safety flaw in IOS Software program and IOS XE Software program that would permit a distant attacker to execute arbitrary code or set off a denial-of-service (DoS) situation below particular circumstances.
The corporate stated the vulnerability, CVE-2025-20352 (CVSS rating: 7.7), has been exploited within the wild, including it turned conscious of it “after native Administrator credentials had been compromised.”
The problem, per the networking gear main, is rooted within the Easy Community Administration Protocol (SNMP) subsystem, arising on account of a stack overflow situation.
An authenticated, distant attacker might exploit the flaw by sending a crafted SNMP packet to an affected system over IPv4 or IPv6 networks, leading to DoS if they’ve low privileges or arbitrary code execution as root if they’ve excessive privileges and in the end take management of the prone system.
Nonetheless, Cisco famous that for this to occur, the next situations have to be met –
- To trigger the DoS, the attacker should have the SNMPv2c or earlier read-only neighborhood string or legitimate SNMPv3 consumer credentials
- To execute code as the basis consumer, the attacker should have the SNMPv1 or v2c read-only neighborhood string or legitimate SNMPv3 consumer credentials and administrative or privilege 15 credentials on the affected system
The corporate stated the problem impacts all variations of SNMP, in addition to Meraki MS390 and Cisco Catalyst 9300 Collection Switches which can be working Meraki CS 17 and earlier. It has been fastened in Cisco IOS XE Software program Launch 17.15.4a. Cisco IOS XR Software program and NX-OS Software program should not impacted.
“This vulnerability impacts all variations of SNMP. All gadgets which have SNMP enabled and haven’t explicitly excluded the affected object ID (OID) ought to be thought of weak,” Cisco stated.
Whereas there are not any workarounds that resolve CVE-2025-20352, one mitigation proposed by Cisco entails permitting solely trusted customers to have SNMP entry on an affected system, and monitoring the methods by working the “present snmp host” command.
“Directors can disable the affected OIDs on a tool,” it added. “Not all software program will assist the OID that’s listed within the mitigation. If the OID just isn’t legitimate for particular software program, then it isn’t affected by this vulnerability. Excluding these OIDs might have an effect on system administration by way of SNMP, equivalent to discovery and {hardware} stock.”
