Cisco has launched safety updates to handle a high-severity zero-day vulnerability in Cisco IOS and IOS XE Software program that’s presently being exploited in assaults.
Tracked as CVE-2025-20352, the flaw is because of a stack-based buffer overflow weak point discovered within the Easy Community Administration Protocol (SNMP) subsystem of susceptible IOS and IOS XE software program, impacting all gadgets with SNMP enabled.
Authenticated, distant attackers with low privileges can exploit this vulnerability to set off denial-of-service (DoS) circumstances on unpatched gadgets. Excessive-privileged attackers, however, can acquire full management of techniques operating susceptible Cisco IOS XE software program by executing code as the foundation consumer.
“An attacker might exploit this vulnerability by sending a crafted SNMP packet to an affected system over IPv4 or IPv6 networks,” Cisco mentioned in a Wednesday advisory.
“The Cisco Product Safety Incident Response Workforce (PSIRT) turned conscious of profitable exploitation of this vulnerability within the wild after native Administrator credentials had been compromised. Cisco strongly recommends that prospects improve to a set software program launch to remediate this vulnerability.”
Whereas there are not any workarounds to handle this vulnerability moreover making use of the patches launched as we speak, Cisco mentioned that directors who cannot instantly improve the susceptible software program can briefly mitigate the difficulty by limiting SNMP entry on an affected system to trusted customers.
“To completely remediate this vulnerability and keep away from future publicity as described on this advisory, Cisco strongly recommends that prospects improve to the mounted software program indicated on this advisory,” the corporate warned.
At the moment, Cisco patched 13 different safety vulnerabilities, together with two for which proof-of-concept exploit code is offered.
The primary one, a Cisco IOS XE mirrored cross-site scripting (XSS) flaw tracked as CVE-2025-20240, can be utilized by an unauthenticated, distant attacker to steal cookies from susceptible gadgets.
The second, tracked as CVE-2025-20149, is a denial-of-service vulnerability that enables authenticated, native attackers to power affected gadgets to reload.
In Could, the corporate additionally mounted a most severity IOS XE flaw impacting Wi-fi LAN Controllers, which enabled unauthenticated attackers to remotely take over gadgets utilizing a hard-coded JSON Net Token (JWT).
46% of environments had passwords cracked, almost doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and information exfiltration traits.
