Cisco IOS 0-Day RCE Vulnerability Actively Targeted

Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software, tracked as CVE-2025-20352, which is being actively exploited in real-world attacks, according to the vendor. The flaw resides in the SNMP subsystem and can cause denial-of-service conditions or remote code execution depending on the attacker’s privilege level, with a CVSS 3.1 score of 7.7 (High).

Exploitation relies on sending specially crafted SNMP packets over IPv4 or IPv6, and high-privilege attackers with specific SNMP credentials can achieve full root remote code execution. The vulnerability affects all versions of SNMP implementations and impacts a broad range of Cisco devices running vulnerable IOS and IOS XE releases, including Meraki MS390 and Cisco Catalyst 9300 Series switches running CS 17 and earlier versions.

Cisco PSIRT confirmed that the flaw is being actively exploited after the compromise of local administrator credentials, and the company has released updates with mitigations such as disabling affected OIDs and restricting SNMP access, with a push for immediate software upgrades. The advisory notes that devices with SNMP enabled should be considered vulnerable unless explicitly excluded, and admins can verify SNMP configuration via specific CLI commands.