As many as 2 million Cisco devices affected by actively exploited 0-day

According to Cisco, as many as 2 million devices running Cisco IOS and Cisco IOS XE are vulnerable to an actively exploited zeroday (CVE-2025-20352) that can remotely crash or execute code on affected systems. The flaw stems from a stack overflow in the IOS component that handles SNMP, and it can be exploited by low-privileged users for a denial-of-service or by higher-privileged users to achieve root-code execution.

The advisory notes that exploitation in the wild begun after local Administrator credentials were compromised, and it urges customers to upgrade to a fixed software release to remediate the issue. To be able to perform a denial-of-service, an attacker would only need the read-only community string or valid SNMPv3 credentials. The Shodan search engine is cited by independent researcher Kevin Beaumont as indicating more than 2 million devices worldwide expose SNMP to Internet interfaces.

The article also points to Cisco’s September security update as the context for the vulnerability, alongside guidance to restrict SNMP access and monitor devices where possible.