Cisco Patches Zero-Day Flaw Affecting Routers and Switches

Cisco on Wednesday announced patches for 14 vulnerabilities in IOS and IOS XE, including a flaw that has been exploited in the wild. The exploited issue, tracked as CVE-2025-20352 (CVSS 7.7), is a stack overflow in the SNMP subsystem that can be triggered by crafted SNMP packets to a vulnerable router or switch.

Attackers with low privileges can create a DoS condition, while high-privileged attackers could exploit it to execute arbitrary code remotely as the root user; to do so, the attacker must have SNMPv1/v2c read-only community strings or valid SNMPv3 credentials and administrative or privilege 15 on the device, according to Cisco advisory.

All devices running vulnerable IOS and IOS XE releases are affected, as well as Meraki MS390 and Catalyst 9300 series switches running Meraki CS 17 and earlier releases, with Cisco urging users to update as soon as possible since the flaw has been exploited in the wild.

The patch round also resolves eight other high-severity bugs that could lead to DoS, code execution during boot, or root-privilege command execution, plus five medium-severity bugs with risks including DoS, XSS, ACL bypass, and PKI access; PoC exploit code exists for two of these, CVE-2025-20240 and CVE-2025-20149, though Cisco says it is not aware of exploitation.

Additional fixes cover Cisco SD-WAN vEdge, Access Point, and Wireless AP software, though Cisco says none of these were observed being exploited in the wild. according to Cisco advisory.