CVE-2025-20352

9.5 CISA KEV

Cisco · IOS and IOS XE

A stack overflow vulnerability in the Cisco IOS and IOS XE SNMP subsystem allows remote authenticated attackers to trigger a denial of service or execute arbitrary code with root privileges.

Executive summary

Cisco IOS and IOS XE software are vulnerable to a stack overflow in the SNMP subsystem that is currently being exploited in the wild, posing a critical risk of system instability and total compromise.

Vulnerability

The vulnerability is a stack-based buffer overflow in the SNMP subsystem. An authenticated remote attacker with low privileges can trigger a denial of service (system reload), while an attacker with high privileges can execute code as the root user.

Business impact

The potential for unauthorized root-level code execution and widespread denial of service on network infrastructure represents a critical business risk. A successful exploit could lead to full loss of control over core networking equipment, resulting in significant operational downtime and the compromise of sensitive network traffic. With a CVSS score of 9.5, this vulnerability is classified as critical, requiring immediate attention to prevent system-wide impact.

Remediation

Immediate Action: Apply the vendor-provided patches specified in the official Cisco Security Advisory immediately to resolve the stack overflow condition.

Proactive Monitoring: Monitor SNMP traffic for anomalous, large, or malformed packets directed at management interfaces and review system logs for unexpected reloads.

Compensating Controls: Restrict access to the SNMP management interface to trusted management subnets only and ensure that SNMP community strings are complex or migrated to SNMPv3 with strong authentication and encryption.

Exploitation status

Public Exploit Available: Yes, multiple public proof-of-concept repositories are available on GitHub.

Analyst recommendation

Given the confirmed active exploitation and the high severity of the vulnerability, organizations must treat this as a top-priority task. Network administrators should verify the status of all Cisco IOS and IOS XE devices and prioritize patching based on the official Cisco guidance. Failure to address this vulnerability exposes the organization to severe risk of persistent compromise or critical network failure.

More Cisco CVEs all →

History

  1. Disclosed CVE record published
  2. Published in the daily brief high section
  3. Published in the daily brief high section
  4. Published in the daily brief kev section
  5. Published in the daily brief kev section
  6. Published in the daily brief kev section
  7. Published in the daily brief kev section
  8. Published in the daily brief kev section
  9. Published in the daily brief kev section
  10. Published in the daily brief kev section
  11. Published in the daily brief kev section
  12. Published in the daily brief kev section
  13. Published in the daily brief kev section
  14. Published in the daily brief kev section
  15. Published in the daily brief kev section
  16. Published in the daily brief kev section
  17. Published in the daily brief kev section
  18. Published in the daily brief kev section
  19. Published in the daily brief kev section
  20. Published in the daily brief kev section
  21. Published in the daily brief kev section
  22. Published in the daily brief kev section
  23. Published in the daily brief kev section
  24. Analyst report written

Sources