Cisco SNMP Vulnerability Actively Exploited to Install Linux Rootkits

Trend Micro researchers have found an active attack campaign, dubbed “Operation Zero Disco,” that targets Cisco devices with a critical SNMP vulnerability. The flaw, tracked as CVE-2025-20352, allows remote code execution and the deployment of Linux rootkits on vulnerable Cisco IOS XE switches. The campaign focuses on older models such as the 9400 and 9300 series, and legacy 3750G devices that lack modern detection capabilities.

Exploitation involves sending malicious SNMP packets to achieve remote code execution, after which a rootkit installs a universal password containing the word “disco” and injects hooks into memory to create fileless backdoors. On 32‑bit devices, exploits include a modified Telnet vulnerability based on CVE-2017-3881, while 64‑bit builds require level 15 privilege to run guest shell functionality.

The attackers also use spoofed IPs and MAC addresses to obfuscate activity, with UDP controllers and ARP spoofing tools supporting remote management and traffic redirection. According to Trend Micro, these techniques demonstrate advanced intrusion methods designed to bypass multiple security layers.