Cisco Warns of Actively Exploited SNMP Vulnerability Allowing RCE or DoS in IOS Software

According to Cisco, on 25 September 2025, Cisco has warned of a high-severity vulnerability in IOS Software and IOS XE Software that could let a remote attacker execute arbitrary code or trigger a DoS under specific conditions. The flaw, CVE-2025-20352 (CVSS 7.7), stems from a stack overflow in the SNMP subsystem and has been observed being exploited in the wild after local Administrator credentials were compromised.

An authenticated, remote attacker could send a crafted SNMP packet to an affected device over IPv4 or IPv6, potentially causing DoS with low-privilege access or arbitrary code execution as root with higher privileges. The issue affects all versions of SNMP, including Meraki MS390 and Cisco Catalyst 9300 Series Switches running Meraki CS 17 and earlier, and is fixed in Cisco IOS XE Software Release 17.15.4a; IOS XR Software and NX-OS Software are not affected.

Mitigations include restricting SNMP access to trusted users and monitoring with the show snmp host command, with admins able to disable the affected OIDs where supported.