CVE-2025-20352: Zero-Day in Cisco IOS & IOS XE SNMP Exploited, Allows DoS and Root RCE

CVE-2025-20352 is a high-severity flaw (CVSS 7.7) affecting the Simple Network Management Protocol (SNMP) subsystem in Cisco IOS and IOS XE software, originating from a stack overflow condition. Cisco reports that the zero-day is under active exploitation, with attackers seen leveraging it after gaining administrative credentials. The vulnerability can cause a denial of service by forcing a device to reload, and with administrative or privilege 15 access, it can lead to root remote code execution.

Affected devices include Cisco IOS and IOS XE devices, Meraki MS390 and Catalyst 9300 Series switches using Meraki CS 17 or earlier, while IOS XR and NX-OS are not impacted. Cisco has published software updates to address the issue, and organisations are advised to check patch status with the Cisco Software Checker, plus implement mitigations such as restricting SNMP access and disabling vulnerable OIDs.

The September 24, 2025 advisory bundle provides the full details of all recent Cisco vulnerabilities, and SOCRadar emphasises the need for timely vulnerability intelligence to prioritise remediation.