Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

🚨SEVERITY: HIGH — CVSS 7.7Security Advisory

TL;DR 📌

  • A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause…
  • Highest CVSS: 7.7 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20352.

What it is

CVE-2025-20352 is a stack overflow in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software. Cisco states the flaw affects all versions of SNMP, and any device with SNMP enabled that has not explicitly excluded the affected object ID (OID) should be considered vulnerable.

The vulnerability is reached by sending a crafted SNMP packet to an affected device over IPv4 or IPv6. Two outcomes are described, both requiring authentication rather than an open management interface:

  • A remote attacker with low privileges who holds the SNMPv2c (or earlier) read-only community string, or valid SNMPv3 user credentials, can trigger a device reload — a denial of service — on IOS or IOS XE.
  • A remote attacker with high privileges — SNMPv1/v2c read-only community string or valid SNMPv3 credentials, plus administrative or privilege 15 credentials on the device — can go further and execute code as the root user on IOS XE, giving full control of the affected system.

Cisco IOS XR Software and NX-OS Software are confirmed not affected. Cisco PSIRT has stated it became aware of successful exploitation of this vulnerability after local Administrator credentials were compromised elsewhere, so the privileged, root-level path has been used in practice; this is part of Cisco’s September 2025 semiannual IOS/IOS XE bundled publication.

What to do

  • Identify exposure: run show running-config | include snmp-server community to check for SNMPv1/v2c community strings, and show running-config | include snmp-server group plus show snmp user to check for SNMPv3 configuration. Any device with SNMP enabled and the affected OID not excluded should be treated as vulnerable.
  • Prioritise devices where SNMP read-only access and separate administrative/privilege 15 credentials could both fall into the same attacker’s hands — that combination enables the root-level code execution path on IOS XE, not just the DoS path.
  • Given the confirmed local Administrator credential compromise noted by Cisco, review and rotate any SNMP community strings and SNMPv3 credentials, and tighten who holds privilege 15/administrative access.
  • There is no workaround, but Cisco has published a mitigation: create an SNMP view excluding the affected OIDs and apply it to community strings or SNMPv3 groups, using the snmp-server view configuration shown in the advisory (excluding snmpUsmMIB, snmpVacmMIB, snmpCommunityMIB, and cafSessionMethodsInfoEntry). Note this can affect SNMP-based device management such as discovery and hardware inventory.
  • Restrict SNMP access to trusted users/sources only, and monitor with show snmp host.
  • Meraki cloud-managed switch customers running an affected release should contact Meraki support to have the mitigation applied.
  • Use the Cisco Software Checker against your running release to identify the fixed release for your specific train, and plan the upgrade — Cisco states the mitigation is a temporary measure and recommends upgrading to remediate fully.

For leadership 🧭

Executive summary. Cisco has confirmed that this SNMP flaw has already been exploited after local administrator credentials were compromised, giving attackers a path to full root control on IOS XE devices or a forced reload on any affected device. Given active exploitation and no available workaround, affected devices need the OID exclusion mitigation applied now and upgrades scheduled at the next opportunity.

Why it matters:

  • Any IOS or IOS XE device with SNMP enabled and the affected OID not excluded is considered vulnerable — Cisco states this covers all versions of SNMP, not a specific release range.
  • An attacker who holds SNMP read-only access plus privilege 15/administrative credentials can execute arbitrary code as root on IOS XE, meaning full device takeover rather than just a service interruption.
  • Cisco PSIRT has confirmed successful exploitation in the wild following a local Administrator credential compromise, so the privileged, root-level path is not theoretical.
  • There is no workaround — only a mitigation that excludes specific OIDs — and applying it can degrade SNMP-based discovery and hardware inventory, which affects monitoring tooling.

Now / Next / Later:

  • Now: Run show running-config | include snmp-server community and the SNMPv3 checks (show running-config | include snmp-server group, show snmp user) across your Cisco IOS/IOS XE estate to identify every device with SNMP enabled and not yet excluding the affected OID.
  • Next: Apply the Cisco-published snmp-server view mitigation to exclude the affected OIDs (snmpUsmMIB, snmpVacmMIB, snmpCommunityMIB, cafSessionMethodsInfoEntry) on identified devices, rotate SNMP community strings and SNMPv3 credentials, and for Meraki-managed switches contact Meraki support to apply the same fix.
  • Later: Use the Cisco Software Checker against each running release to schedule upgrades to fixed IOS/IOS XE software, and tighten separation between SNMP read-only access and privilege 15/administrative credentials so the two can’t be combined by a single compromised account.

Source