Security Digest · Sep 24, 2025 · Vulnerability · Network edge
Cisco IOS/IOS XE SNMP CVE-2025-20352: DoS to Root RCE
SNMP stack overflow in Cisco IOS and IOS XE, exploited with stolen credentials to plant rootkits on Catalyst switches. Confirm upgrades and lock down SNMP.
Our verdict
Check exposure
Fixed since September 2025 and it needs SNMP credentials, but attackers used it to plant rootkits on Catalyst switches; confirm every IOS and IOS XE device is upgraded, SNMP is locked down, and old switches are replaced.
Who must act: Owners of Cisco IOS or IOS XE routers and switches with SNMP enabled that have not been upgraded since September 2025, especially where community strings are weak or SNMP is reachable from user networks, and anyone still running end-of-life switches such as the Catalyst 3750G.
Who can relax: Devices with SNMP disabled or already on a fixed release, and IOS XR and NX-OS, which are not affected.
- Affected
- Cisco IOS and IOS XE releases listed in the advisory, with any SNMP version enabled and the affected OIDs not excluded
IOS XE Catalyst SD-WAN releases listed in the CVE record
Root code execution applies to IOS XE only - Fixed in
- First fixed release per train via the Cisco Software Checker (the advisory lists no build numbers)
IOS XE 17.15.4a, per The Hacker News at disclosure - CVSS
- 7.7 (v3.1, vendor)
- EPSS
- 41.5% (percentile 99)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- High
What to do
- Check SNMP on every IOS and IOS XE device with show running-config | include snmp-server community, show running-config | include snmp-server group and show snmp user.
- Upgrade to the first fixed release for each train from the Cisco Software Checker.
- Restrict SNMP to management stations with ACLs, remove unused or default community strings, and disable SNMP where nothing polls it.
- Rotate SNMP community strings, SNMPv3 credentials and local administrator passwords, since exploitation began with stolen admin credentials.
- Until a device is upgraded, apply Cisco's NO_BAD_SNMP view that excludes cafSessionMethodsInfoEntry and the SNMP security MIBs.
- Replace end-of-life switches such as the Catalyst 3750G, which will not get a fix.
How to check if you are affected or compromised
- Look for unexplained reloads on devices with SNMP enabled; a crafted packet that fails to get code execution still crashes the device.
- Search running configurations for EEM applets named CiscoEMX-1 to CiscoEMX-5 and ACLs named EnaQWklg0 to EnaQWklg2, which Trend Micro tied to the rootkit.
- Review SNMP traffic and Snort rule 65356 hits for requests from hosts that are not your monitoring systems.
- If a switch is suspected, ask Cisco TAC for a low-level firmware and ROM investigation; Trend Micro says no automated tool can reliably confirm compromise.
What happened#
On September 24, 2025, Cisco published cisco-sa-snmp-x4LPhte for CVE-2025-20352, a stack overflow (CWE-121) in the SNMP subsystem of Cisco IOS and IOS XE software. A crafted SNMP packet over IPv4 or IPv6 triggers it, and every SNMP version is affected. The outcome depends on what the attacker holds:
- Denial of service: an SNMPv2c or earlier read-only community string, or valid SNMPv3 credentials, is enough to make the device reload.
- Root code execution (IOS XE only): the same SNMP access plus administrative or privilege 15 credentials on the device.
Cisco scores it CVSS 3.1 7.7 (High), the only score on NVD. Cisco found the bug during a TAC case and says it became aware of successful exploitation "after local Administrator credentials were compromised." CISA added the CVE to the KEV catalog on September 29, 2025, with an October 20 deadline.
On October 15, Trend Micro described the campaign, which it named Operation Zero Disco. Attackers hit Catalyst 9300 and 9400 switches and legacy 3750G devices. They installed a fileless rootkit that hooks IOSd memory and sets a universal password containing the word "disco". A UDP controller lets them hide logs, bypass AAA and VTY ACLs, and conceal parts of the running configuration. The implant disappears on reboot. Trend named no actor.
Who is affected#
Any device running an affected IOS or IOS XE release with SNMP enabled and the vulnerable OIDs not excluded. The CVE record lists hundreds of IOS and IOS XE releases plus IOS XE Catalyst SD-WAN builds. IOS XR and NX-OS are not affected. The advisory lists no fixed builds and points to the Cisco Software Checker. At disclosure, The Hacker News reported that IOS XE 17.15.4a carried the fix and that Meraki MS390 and Catalyst 9300 switches on Meraki CS 17 and earlier were affected. Cisco now tells Meraki customers to contact Meraki support.
Do you really need to act?#
Check, yes. The credential requirement makes this sound tame, but read-only community strings are often defaults or widely shared. The observed attackers also already had admin credentials. Root on a core switch gives them a quiet foothold that survives everything except a reboot. Most well-run networks patched in late 2025. Devices that were missed, and end-of-life switches like the 3750G that will not get a fix, are the real exposure. As of today, KEV lists no IOS XE bug newer than this one.
What to do now#
- Find SNMP on each device:
show running-config | include snmp-server community,show running-config | include snmp-server groupandshow snmp user. - Upgrade to the first fixed release for each train from the Software Checker.
- Restrict SNMP to management stations with ACLs, remove default community strings, and disable SNMP where nothing polls it.
- Rotate community strings, SNMPv3 credentials and local admin passwords.
- Until an upgrade, apply Cisco's temporary view:
snmp-server view NO_BAD_SNMP iso included, then excludesnmpUsmMIB,snmpVacmMIB,snmpCommunityMIBandcafSessionMethodsInfoEntry, and bind it withsnmp-server community mycomm view NO_BAD_SNMP RO. It may affect SNMP inventory tools. - Replace end-of-life switches.
How to tell if you were hit#
Unexplained reloads on SNMP-enabled devices are the first clue. Search configurations for EEM applets named CiscoEMX-1 to CiscoEMX-5 and ACLs named EnaQWklg0 to EnaQWklg2, which Trend tied to the rootkit. Review SNMP traffic from hosts that are not your pollers. Cisco lists Snort rule 65356. Trend says no automated tool can reliably confirm a compromised switch, so ask Cisco TAC for a low-level firmware and ROM check. Because the implant clears on reboot, collect evidence before restarting.
Timeline#
- — Cisco publishes the advisory, citing exploitation.
- — CISA adds CVE-2025-20352 to KEV.
- — Cisco updates the mitigation CLI and Meraki guidance (version 2.3).
- — Trend Micro publishes Operation Zero Disco.
- — CISA's federal deadline.
Vulnerability records
- CVE-2025-20352 · KEV 2025-09-29 · A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An…
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- Cisco — Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability (cisco-sa-snmp-x4LPhte) sec.cloudapps.cisco.com
- CVE record — CVE-2025-20352 cve.org
- NVD — CVE-2025-20352 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2025-20352 cisa.gov
- Trend Micro — Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits trendmicro.com