HighCISA KEVExploited in the wildPublic exploit

Cisco IOS and IOS XE SNMP Stack Overflow RCE/DoS

IdentifiersCVE-2025-20352CWE-121· Stack-based Buffer Overflow

CVE-2025-20352 is a stack-based buffer overflow in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software. The flaw is triggered by a crafted SNMP packet sent over IPv4 or IPv6 to an affected device. According to the provided advisory content, exploitation paths differ by privilege level: a remote authenticated attacker with low privileges can cause a denial-of-service condition on Cisco IOS or IOS XE if they possess the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials; a remote authenticated attacker with higher privileges can achieve arbitrary code execution as root on Cisco IOS XE if they possess SNMPv1/v2c read-only community access or valid SNMPv3 credentials together with administrative or privilege 15 credentials on the device. Cisco notes that all versions of SNMP are affected.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause either device reload and service interruption or full device compromise, depending on attacker privileges and platform. In the lower-privilege case, the attacker can crash or reload the affected system, producing a denial of service. In the higher-privilege IOS XE case, the attacker can execute arbitrary code as root, obtain full control of the device, and potentially use the compromised network infrastructure for persistence, traffic manipulation, concealment, and lateral movement. The supplied context also notes active exploitation in the wild and reporting of rootkit deployment on affected Cisco switches.

Mitigation

If you can’t patch tonight, do this now.

Restrict SNMP access to trusted management hosts and users only. Prefer SNMPv3 with strong credentials and minimize or eliminate use of SNMPv1/v2c community strings, especially broadly known read-only strings. Limit exposure of SNMP services and management interfaces through ACLs, segmentation, and filtering. Cisco-provided mitigation includes disabling affected OIDs using the 'snmp-server view' command and applying that view to SNMP community strings or SNMPv3 groups; this may reduce exposure but can affect SNMP-based monitoring. Monitor SNMP traffic and device behavior for anomalous crafted requests, unexpected reloads, hidden configuration changes, suspicious UDP listeners, or other indicators of compromise. Where feasible, disable SNMP if not operationally required.

Remediation

Patch, then assume compromise.

Upgrade affected Cisco IOS and Cisco IOS XE devices to a fixed software release identified by Cisco. Use Cisco's Software Checker and the vendor advisory to determine the appropriate remediated version for each platform. For downstream affected products such as Rockwell Stratix devices built on Cisco technology, apply the vendor-provided corrected firmware versions when available. Patch prioritization should be high because the vulnerability is reported as actively exploited in the wild and has been added to CISA KEV.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Cisco SystemsIosoperating_system

Cisco SystemsIos Xeoperating_system

Cisco SystemsIos Xe Sd-Wanoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

208 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

208 SOURCESView more in app

cloudatg insightsNews

Feb 13, 2026

AI Development & Software Engineering | CloudATG

A Cisco IOS/IOS XE SNMP flaw that can enable remote code execution or denial of service and is reported as exploited in the wild.

cyber security newsNews

Jan 6, 2026

CISA Expands KEV Catalog with 1,484 New Vulnerabilities as Active Exploitation Surges 20% in 2025

A stack-based buffer overflow vulnerability in Cisco IOS/IOS XE SNMP functionality, confirmed to be actively exploited.

cyberthroneNews

Dec 26, 2025

When Silence Broke Security: Zero-Days in 2025 - TheCyberThrone

Remote code execution zero-day in Cisco IOS/IOS-XE described as exploited (per threat intelligence reporting).

socradar blogNews

Dec 1, 2025

CISA Industrial Control Systems (ICS) Advisories Recap for 2025

A stack-based buffer overflow in Cisco IOS and IOS XE SNMP subsystem allowing DoS or remote code execution, actively exploited in the wild and affecting millions of devices, including industrial switches.

+22 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware1

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity171

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2025-20352

NVD

nvd.nist.gov/vuln/detail/CVE-2025-20352

MITRE CWE · CWE-121

Stack-based Buffer Overflow

Vendor Advisory

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20352