Cisco Patches Zero-Day Flaw Affecting Routers and Switches

"The exploited flaw, tracked as CVE-2025-20352 (CVSS score of 7.7), is described as a stack overflow condition in the Simple Network Management Protocol (SNMP) subsystem of IOS and IOS XE that can be exploited by sending crafted SNMP packets to a vulnerable router or switch. Attackers with low privileges, Cisco explains, can exploit the issue to cause a denial-of-service (DoS) condition. High-privileged attackers could exploit it to execute arbitrary code remotely as the root user."

"Cisco urges users to update their devices to a patched release as soon as possible, as the security defect has been exploited in the wild by attackers using compromised administrator credentials. The fresh round of IOS and IOS XE patches, announced as part of Cisco's semiannual bundled publication, resolves eight other high-severity vulnerabilities that could lead to DoS conditions, code execution during boot, command execution with root privileges, authentication bypass, and data leaks."

Patch updates were released for 14 vulnerabilities in IOS and IOS XE, including an exploited SNMP stack overflow tracked as CVE-2025-20352 (CVSS 7.7). The SNMP flaw allows crafted SNMP packets to cause denial-of-service by low-privileged attackers or enable remote arbitrary code execution as root by high-privileged attackers possessing SNMPv1/v2c read-only community strings or valid SNMPv3 credentials plus administrative or privilege 15 access. All vulnerable IOS and IOS XE releases and Meraki MS390 and Catalyst 9300 switches running Meraki CS 17 or earlier are affected. Proof-of-concept code exists for two other issues; multiple high- and medium-severity bugs were fixed.

Read at SecurityWeek