Cisco SNMP Flaw (CVE-2025-20352) Actively Exploited: Patch Now to Stop Root Access!

Cisco has issued a security advisory warning of a critical flaw in its IOS and IOS XE Software, tracked as CVE-2025-20352, which has already been exploited in the wild and carries a CVSS score of 7.7. The vulnerability stems from a stack overflow in the SNMP subsystem and could allow an authenticated, remote attacker with low or high privileges to cause a DoS or to execute code as the root user, potentially giving full control of the affected device.

Affected products include Cisco IOS Software, Cisco IOS XE Software, and Meraki MS390 and Cisco Catalyst 9300 Series Switches running Meraki CS 17 or earlier, with a fix in Cisco IOS XE Software Release 17.15.4a. The Cisco PSIRT has confirmed active exploitation after local Administrator credentials were compromised, making patching urgent for organisations relying on Cisco networking gear.

There are no complete workarounds, though administrators are advised to restrict SNMP access to trusted users and may apply SNMP view exclusions, noting they could disrupt device management.