Critical Cisco IOS and IOS XE Flaws Allow Remote Code Execution

Cisco has disclosed a serious vulnerability in its IOS and IOS XE Software that could allow attackers to execute remote code or crash affected devices, tracked as CVE-2025-20352 with a CVSS score of 7.7. The flaw arises from a stack overflow in the SNMP subsystem that processes network management traffic and presents a dual threat: with low-level privileges it can cause denial of service, while with high-level administrative access it can enable arbitrary code execution with root privileges.

According to Cisco, the issue affects all versions of IOS and IOS XE Software with SNMP enabled, and devices should be updated because Cisco has released software updates that fully address the vulnerability; XR and NX-OS are not affected. Exploitation requires an attacker to send a specially crafted SNMP packet over IPv4 or IPv6, using SNMPv2c or earlier read-only community strings or valid SNMPv3 credentials, with remote code execution potentially needing administrative or privilege 15 credentials.

Temporary mitigations exist, such as restricting SNMP access to trusted users and disabling affected object identifiers, though these may impact device management capabilities. The vulnerability was first published on 24 September 2025 as part of Cisco’s semiannual security advisory bundle. According to Cisco, organisations can use its Software Checker tool to identify affected releases and determine fixed versions for their deployments.