Cisco fixed actively exploited zero-day in Cisco IOS and IOS XE software

Cisco fixed an actively exploited zero-day in Cisco IOS and IOS XE Software, tracked as CVE-2025-20352, which affects the SNMP subsystem and can be triggered by a crafted SNMP packet over IPv4 or IPv6. The vulnerability allows remote authenticated attackers with low privileges to cause a DoS on affected devices, or with higher privileges to execute code as the root user on IOS XE—highlights of the flaw noted in the security advisory.

The root cause is a stack overflow in the SNMP subsystem, and the advisory states that attacks in the wild are exploiting it after local Administrator credentials were compromised. The company states there are no workarounds, and it is recommended that customers upgrade to a fixed software release and restrict SNMP access to trusted users as a temporary mitigation.

According to The Cisco Product Security Incident Response Team (PSIRT), the situation underscores the importance of immediate remediation for affected devices. Cisco fixed the issue as high-severity, with exploitation already observed in the wild and calls to upgrade."