Operation Zero Disco: Critical Cisco SNMP Flaw (CVE-2025-20352) Used to Implant Linux Rootkits on Switches

Operation Zero Disco is a campaign in which attackers exploit Cisco SNMP vulnerability CVE-2025-20352 to implant Linux rootkits on vulnerable Cisco switches, enabling remote code execution, persistent access and stealthy manipulation of network configurations. According to Trend Research, the attackers weaponise the flaw to deploy rootkits on older, unprotected systems, gaining control by setting universal passwords and installing hooks into the IOSd memory space.

The assaults primarily target Cisco 9400, 9300 and legacy 3750G series switches, especially those running outdated Linux without EDR protection, with the rootkit acting as a UDP listener that accepts covert commands from any IP address even if the port is closed. Once inside, the malware can bypass authentication, hide accounts and logs, and perform ARP spoofing to redirect traffic, effectively hijacking network communications.

Cisco has issued a security advisory and updates for CVE-2025-20352, urging organisations to disable unnecessary SNMP, change default community strings and apply firmware updates immediately.