Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution
CVE-2025-20352 is a high-severity stack-based buffer overflow vulnerability in IOS from Cisco, with a CVSS 3.1 base score of 7.7 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected IOS versions: 12.2(55)SE; 12.2(55)SE3; 12.2(55)SE2, and others listed below. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on September 29, 2025, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of IOS you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Read the advisory on sec.cloudapps.cisco.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Cisco | IOS | 12.2(55)SE; 12.2(55)SE3; 12.2(55)SE2; 12.2(58)SE; 12.2(55)SE1; 12.2(58)SE1; 12.2(55)SE4; 12.2(58)SE2; and 32 more ranges | Not stated |
| Cisco | Cisco IOS XE Software | 3.5.0E; 3.5.1E; 3.5.2E; 3.5.3E; 3.6.0E; 3.6.1E; 3.6.2aE; 3.6.2E; and 32 more ranges | Not stated |
| Cisco | Cisco IOS XE Catalyst SD-WAN | 16.9.1; 16.9.2; 16.9.3; 16.9.4; 16.10.1; 16.10.2; 16.10.3; 16.10.3a; and 13 more ranges | Not stated |
| Cisco | iOS Xe Sd-wan | 16.9.1; 16.9.2; 16.9.3; 16.9.4; 16.10.1; 16.10.2; 16.10.3; 16.10.3a; and 13 more ranges | Not stated |
| Cisco | iOS Xe | 3.5.0e; 3.5.0sq; 3.5.1e; 3.5.1sq; 3.5.2e; 3.5.2sq; 3.5.3e; 3.5.3sq; and 32 more ranges | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. Scored by CNA (cisco.com).
Official description
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials. An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. This vulnerability is due to a stack overflow condition in the SNMP subsystem of the affected software. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Note: This vulnerability affects all versions of SNMP.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Stack-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the stack.
How developers prevent this class of flaw
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
- Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Implement and perform bounds checking on input.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- Record last changed materially (score, affected products, status or references).
References
Advisories
Third-party and government advisories
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20352US Government Resource
Other vulnerabilities in IOS
- 8.6 High severity
- 7.7 High severity
- 8.6 High severity
- 9.0 Critical severity
- 7.7 High severity
- 8.1 High severity
Recent Stack-based Buffer Overflow vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
- 7.0 High severity
Spotted an error? Tell us.