---
title: "Cisco IOS/IOS XE SNMP CVE-2025-20352: DoS to Root RCE"
url: https://erroneo.us/security/briefs/cisco-ios-xe-snmp-cve-2025-20352-dos-rce/
description: "SNMP stack overflow in Cisco IOS and IOS XE, exploited with stolen credentials to plant rootkits on Catalyst switches. Confirm upgrades and lock down SNMP."
type: security-brief
section: "Security Digest"
date_published: 2025-09-24
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-20352"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco IOS/IOS XE SNMP CVE-2025-20352: DoS to Root RCE

**Verdict: Check exposure.** Fixed since September 2025 and it needs SNMP credentials, but attackers used it to plant rootkits on Catalyst switches; confirm every IOS and IOS XE device is upgraded, SNMP is locked down, and old switches are replaced.

- **Who must act:** Owners of Cisco IOS or IOS XE routers and switches with SNMP enabled that have not been upgraded since September 2025, especially where community strings are weak or SNMP is reachable from user networks, and anyone still running end-of-life switches such as the Catalyst 3750G.
- **Who can relax:** Devices with SNMP disabled or already on a fixed release, and IOS XR and NX-OS, which are not affected.
- **Affected:** Cisco IOS and IOS XE releases listed in the advisory, with any SNMP version enabled and the affected OIDs not excluded; IOS XE Catalyst SD-WAN releases listed in the CVE record; Root code execution applies to IOS XE only
- **Fixed:** First fixed release per train via the Cisco Software Checker (the advisory lists no build numbers); IOS XE 17.15.4a, per The Hacker News at disclosure
- **CVEs:** CVE-2025-20352
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check SNMP on every IOS and IOS XE device with show running-config | include snmp-server community, show running-config | include snmp-server group and show snmp user.
2. Upgrade to the first fixed release for each train from the Cisco Software Checker.
3. Restrict SNMP to management stations with ACLs, remove unused or default community strings, and disable SNMP where nothing polls it.
4. Rotate SNMP community strings, SNMPv3 credentials and local administrator passwords, since exploitation began with stolen admin credentials.
5. Until a device is upgraded, apply Cisco's NO_BAD_SNMP view that excludes cafSessionMethodsInfoEntry and the SNMP security MIBs.
6. Replace end-of-life switches such as the Catalyst 3750G, which will not get a fix.

### How to check if you are affected

- Look for unexplained reloads on devices with SNMP enabled; a crafted packet that fails to get code execution still crashes the device.
- Search running configurations for EEM applets named CiscoEMX-1 to CiscoEMX-5 and ACLs named EnaQWklg0 to EnaQWklg2, which Trend Micro tied to the rootkit.
- Review SNMP traffic and Snort rule 65356 hits for requests from hosts that are not your monitoring systems.
- If a switch is suspected, ask Cisco TAC for a low-level firmware and ROM investigation; Trend Micro says no automated tool can reliably confirm compromise.

## What happened

On September 24, 2025, Cisco published [cisco-sa-snmp-x4LPhte](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte) for CVE-2025-20352, a stack overflow (CWE-121) in the SNMP subsystem of Cisco IOS and IOS XE software. A crafted SNMP packet over IPv4 or IPv6 triggers it, and every SNMP version is affected. The outcome depends on what the attacker holds:

- **Denial of service:** an SNMPv2c or earlier read-only community string, or valid SNMPv3 credentials, is enough to make the device reload.
- **Root code execution (IOS XE only):** the same SNMP access plus administrative or privilege 15 credentials on the device.

Cisco scores it CVSS 3.1 7.7 (High), the only score on [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-20352). Cisco found the bug during a TAC case and says it became aware of successful exploitation "after local Administrator credentials were compromised." CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20352) on September 29, 2025, with an October 20 deadline.

On October 15, [Trend Micro](https://www.trendmicro.com/en/research/25/j/operation-zero-disco-cisco-snmp-vulnerability-exploit.html) described the campaign, which it named Operation Zero Disco. Attackers hit Catalyst 9300 and 9400 switches and legacy 3750G devices. They installed a fileless rootkit that hooks IOSd memory and sets a universal password containing the word "disco". A UDP controller lets them hide logs, bypass AAA and VTY ACLs, and conceal parts of the running configuration. The implant disappears on reboot. Trend named no actor.

## Who is affected

Any device running an affected IOS or IOS XE release with SNMP enabled and the vulnerable OIDs not excluded. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-20352) lists hundreds of IOS and IOS XE releases plus IOS XE Catalyst SD-WAN builds. IOS XR and NX-OS are not affected. The advisory lists no fixed builds and points to the Cisco Software Checker. At disclosure, [The Hacker News](https://thehackernews.com/2025/09/cisco-warns-of-actively-exploited-snmp.html) reported that IOS XE 17.15.4a carried the fix and that Meraki MS390 and Catalyst 9300 switches on Meraki CS 17 and earlier were affected. Cisco now tells Meraki customers to contact Meraki support.

## Do you really need to act?

Check, yes. The credential requirement makes this sound tame, but read-only community strings are often defaults or widely shared. The observed attackers also already had admin credentials. Root on a core switch gives them a quiet foothold that survives everything except a reboot. Most well-run networks patched in late 2025. Devices that were missed, and end-of-life switches like the 3750G that will not get a fix, are the real exposure. As of today, KEV lists no IOS XE bug newer than this one.

## What to do now

1. Find SNMP on each device: `show running-config | include snmp-server community`, `show running-config | include snmp-server group` and `show snmp user`.
2. Upgrade to the first fixed release for each train from the Software Checker.
3. Restrict SNMP to management stations with ACLs, remove default community strings, and disable SNMP where nothing polls it.
4. Rotate community strings, SNMPv3 credentials and local admin passwords.
5. Until an upgrade, apply Cisco's temporary view: `snmp-server view NO_BAD_SNMP iso included`, then exclude `snmpUsmMIB`, `snmpVacmMIB`, `snmpCommunityMIB` and `cafSessionMethodsInfoEntry`, and bind it with `snmp-server community mycomm view NO_BAD_SNMP RO`. It may affect SNMP inventory tools.
6. Replace end-of-life switches.

## How to tell if you were hit

Unexplained reloads on SNMP-enabled devices are the first clue. Search configurations for EEM applets named `CiscoEMX-1` to `CiscoEMX-5` and ACLs named `EnaQWklg0` to `EnaQWklg2`, which Trend tied to the rootkit. Review SNMP traffic from hosts that are not your pollers. Cisco lists Snort rule 65356. Trend says no automated tool can reliably confirm a compromised switch, so ask Cisco TAC for a low-level firmware and ROM check. Because the implant clears on reboot, collect evidence before restarting.

## Timeline

- Sep 24, 2025 — Cisco publishes the advisory, citing exploitation.
- Sep 29, 2025 — CISA adds CVE-2025-20352 to KEV.
- Oct 6, 2025 — Cisco updates the mitigation CLI and Meraki guidance (version 2.3).
- Oct 15, 2025 — Trend Micro publishes Operation Zero Disco.
- Oct 20, 2025 — CISA's federal deadline.

## Sources

1. [Cisco — Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability (cisco-sa-snmp-x4LPhte)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte)
2. [CVE record — CVE-2025-20352](https://www.cve.org/CVERecord?id=CVE-2025-20352)
3. [NVD — CVE-2025-20352](https://nvd.nist.gov/vuln/detail/CVE-2025-20352)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-20352](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20352)
5. [Trend Micro — Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits](https://www.trendmicro.com/en/research/25/j/operation-zero-disco-cisco-snmp-vulnerability-exploit.html)
6. [The Hacker News — Cisco Warns of Actively Exploited SNMP Vulnerability Allowing RCE or DoS in IOS Software](https://thehackernews.com/2025/09/cisco-warns-of-actively-exploited-snmp.html)

---
Source page: https://erroneo.us/security/briefs/cisco-ios-xe-snmp-cve-2025-20352-dos-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt