Cisco Addresses Critical Zero-Day Vulnerability in IOS and IOS XE

Cisco has announced the release of emergency security patches for a critical zero-day vulnerability, tracked as CVE-2025-20352, affecting its IOS and IOS XE software. This flaw, which has been actively exploited in the wild, poses significant risks to enterprise network devices worldwide. The vulnerability is categorized as a stack-based buffer overflow in the Simple Network Management Protocol (SNMP) subsystem, with a CVSS score of 7.7, indicating high severity.

Cisco Patches Critical IOS Zero-Day Under Active Attack—Millions of Network Devices at RiskCVE-2025-20352: Zero-Day in Cisco IOS & IOS XE SNMP Exploited, Allows DoS and Root RCEZero-Day Vulnerabilities Found in Cisco IOS and IOS XE: Urgent UpdatesCisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352)Cisco Patches Zero-Day Flaw Affecting Routers and SwitchesCisco Confirms Actively-Exploited 0-Day RCE in IOS and IOS-XE

CVE-2025-20352 allows attackers to exploit vulnerable devices by sending specially crafted SNMP packets over IPv4 or IPv6 networks. Depending on the attacker's privilege level, the vulnerability can lead to two distinct outcomes: low-privileged attackers can trigger a denial-of-service (DoS) condition, causing affected systems to reload, while high-privileged attackers can execute arbitrary code as the root user, gaining full control over the system. Attackers require specific credentials to exploit this vulnerability; low-privileged access necessitates an SNMPv2c read-only community string or valid SNMPv3 user credentials, while high-privileged access requires administrative or privilege 15 credentials.

Zero-Day Vulnerabilities Found in Cisco IOS and IOS XE: Urgent UpdatesCisco Patches Zero-Day Flaw Affecting Routers and SwitchesCisco Confirms Actively-Exploited 0-Day RCE in IOS and IOS-XECisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352)Cisco Patches Critical IOS Zero-Day Under Active Attack—Millions of Network Devices at RiskCVE-2025-20352: Zero-Day in Cisco IOS & IOS XE SNMP Exploited, Allows DoS and Root RCE

The vulnerability impacts a wide range of Cisco devices, including older models of Cisco Catalyst switches, Integrated Services Routers, and small enterprise routers, as well as many legacy platforms. Specifically, Meraki MS390 and Cisco Catalyst 9300 Series switches running Meraki CS 17 and earlier versions are also affected. Cisco has advised network administrators to verify their devices using the Cisco Software Checker to determine if they are running vulnerable software.

Cisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352)Cisco Confirms Actively-Exploited 0-Day RCE in IOS and IOS-XEZero-Day Vulnerabilities Found in Cisco IOS and IOS XE: Urgent UpdatesCVE-2025-20352: Zero-Day in Cisco IOS & IOS XE SNMP Exploited, Allows DoS and Root RCECisco Patches Zero-Day Flaw Affecting Routers and SwitchesCisco Patches Critical IOS Zero-Day Under Active Attack—Millions of Network Devices at Risk

Cisco's Product Security Incident Response Team (PSIRT) confirmed the active exploitation of this vulnerability, noting that it was discovered during a Technical Assistance Center support case. The company emphasized the urgency of upgrading to patched software releases to mitigate the risks associated with this flaw. Cisco has also recommended temporary mitigations, such as restricting SNMP access to trusted users and disabling vulnerable Object Identifiers (OIDs).

Cisco Confirms Actively-Exploited 0-Day RCE in IOS and IOS-XECisco Patches Critical IOS Zero-Day Under Active Attack—Millions of Network Devices at RiskZero-Day Vulnerabilities Found in Cisco IOS and IOS XE: Urgent UpdatesCisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352)Cisco Patches Zero-Day Flaw Affecting Routers and SwitchesCVE-2025-20352: Zero-Day in Cisco IOS & IOS XE SNMP Exploited, Allows DoS and Root RCE

While Cisco has taken steps to address the vulnerability, some cybersecurity experts have raised concerns about the adequacy of the response time and the potential impact on organizations that may not be able to patch their systems immediately. The lack of complete workarounds has also been criticized, as it leaves many devices vulnerable until patches can be applied.

Cisco Patches Critical IOS Zero-Day Under Active Attack—Millions of Network Devices at Risk

In light of this vulnerability, network administrators are urged to prioritize the patching of affected systems and to monitor their networks closely for any signs of exploitation. Cisco's advisory highlights the importance of robust credential management and rapid deployment of security updates to protect against such vulnerabilities in the future.

Cisco Patches Critical IOS Zero-Day Under Active Attack—Millions of Network Devices at RiskCisco Confirms Actively-Exploited 0-Day RCE in IOS and IOS-XEZero-Day Vulnerabilities Found in Cisco IOS and IOS XE: Urgent UpdatesCisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352)Cisco Patches Zero-Day Flaw Affecting Routers and SwitchesCVE-2025-20352: Zero-Day in Cisco IOS & IOS XE SNMP Exploited, Allows DoS and Root RCE

• “A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system,” — Cisco

Cisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352)

• “The Cisco Product Security Incident Response Team (PSIRT) became aware of successful exploitation of this vulnerability in the wild after local Administrator credentials were compromised,” — Cisco

Cisco Patches Critical IOS Zero-Day Under Active Attack—Millions of Network Devices at Risk

This incident underscores the ongoing challenges in network security and the critical need for organizations to remain vigilant against emerging threats.

Cisco Patches Critical IOS Zero-Day Under Active Attack—Millions of Network Devices at Risk