Cisco IOS/IOS XE SNMP Vulnerabilities Exploited in Ongoing Attacks, Warns CISA

The Cybersecurity and Infrastructure Security Agency has issued a warning about critical vulnerabilities in Cisco’s IOS and IOS XE Software SNMP subsystem that are actively being exploited by threat actors, with CVE-2025-20352 added to CISA’s KEV catalog. According to the advisory, a stack-based buffer overflow in SNMP could be triggered by a malformed packet, potentially allowing remote code execution or a denial-of-service condition.

Evidence from in-the-wild activity shows automated scanning tooling identifying exposed SNMP endpoints on the Internet. While the article notes it is unclear which threat group is responsible, the risk is significant given the prevalence of Cisco routers and switches in many networks, and CVE-2025-20352 has been included in the KEV catalog to guide prioritisation and patching.

Cisco has released software updates addressing the SNMP buffer overflow, and administrators are urged to review affected versions, apply patches, disable SNMP or limit access with ACLs, and monitor for unusual SNMP traffic. In addition, guidance from CISA’s KEV and BOD 22-01 should be used to bolster vulnerability management and incident response planning. October 1, 2025.