Cisco has confirmed an active zero-day vulnerability, CVE-2025-20352, in the SNMP subsystem of its IOS and IOS XE software. The flaw can allow an attacker to trigger remote code execution (RCE) or cause a denial of service (DoS) condition on affected devices.
Key details:
The root cause is a stack overflow in SNMP handling (CWE-121).
It affects SNMP v1, v2c, and v3 equally.
An attacker can exploit this via a crafted SNMP packet over IPv4 or IPv6.
With lower privileges (e.g., valid SNMP read-only credentials), attackers may cause device reloading (DoS).
With higher privileges (e.g., admin / privilege 15), in IOS XE this can escalate to full code execution as root.
Some of the specifically impacted devices include Meraki MS390 and Cisco Catalyst 9300 series when running vulnerable IOS/IOS XE versions with SNMP enabled. Cisco has released patched software to remediate this vulnerability.
Risks
The vulnerability presents multiple risks depending on the attacker’s access level:
Device hijacking: Full code execution with elevated privileges allows attackers to take over the system.
Service disruption: Even with limited SNMP credentials, attackers may repeatedly crash devices.
Persistence: Once compromised, attackers can maintain control and bypass detection.
Because SNMP is widely used for monitoring, the broad applicability of this flaw increases the likelihood of exploitation.
Affected Versions
Cisco confirmed that IOS and IOS XE devices with SNMP enabled are vulnerable. This includes popular enterprise gear such as Meraki MS390 and Catalyst 9300 series, if running unpatched software prior to the release containing fixes (e.g., IOS XE 17.15.4a).
Remediation
Whether you’re a large enterprise or a smaller organization, the following steps are recommended:
Restrict SNMP access
Keep SNMP internal or whitelist trusted hosts only.
Do not expose SNMP to the public internet.
Apply Cisco patches
Identify your device’s IOS/IOS XE version.
Upgrade to a fixed release such as IOS XE 17.15.4a or later.
Use SNMP view exclusion (temporary mitigation)
Apply Cisco’s suggested OID view restriction to block vulnerable SNMP paths.
Be aware this may affect network monitoring tools.
Monitor for anomalies
Check logs for unusual SNMP traffic, reboots, or privilege escalations.
Integrate SNMP monitoring with security alerts.
Strengthen SNMP credentials
Rotate SNMP community strings.
Avoid default or weak credentials.
Enforce least privilege where possible.
Conclusion
CVE-2025-20352 highlights how critical it is to secure SNMP. Because this protocol is so commonly enabled for device monitoring, attackers see it as an attractive entry point. By limiting SNMP exposure, applying Cisco’s fixes, and monitoring activity, organizations can reduce their risk significantly.
While this vulnerability is already being exploited in the wild, taking swift action now will help protect both enterprise and service provider networks from compromise.
References
Cisco Security Advisories (PSIRT)
CISA Emergency Directive 25-03
CyberSecurityNews coverage of CVE-2025-20352
