CVE-2025-20352: Cisco IOS and IOS XE SNMP stack overflow allows DoS and root code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is in CISA KEV with known exploitation, carries a high EPSS probability, and can lead to root-level code execution on IOS XE devices.

What it is

A stack-based buffer overflow in the SNMP subsystem of Cisco IOS and IOS XE Software can be triggered by a crafted SNMP packet sent over IPv4 or IPv6. An attacker holding an SNMPv2c or earlier read-only community string, or valid SNMPv3 credentials, can crash the device; with administrative or privilege 15 credentials on IOS XE, the same flaw can yield root-level code execution. The advisory notes all versions of SNMP are affected.

Impact

A low-privileged authenticated attacker can reload the device, causing a denial of service. A high-privileged authenticated attacker on IOS XE can execute arbitrary code as root and take full control of the device.

Attack surface

Reachable remotely over the network via crafted SNMP packets on IPv4 or IPv6; no user interaction is required, but the attacker must already possess SNMP read-only community strings or valid SNMPv3 credentials, and for code execution also administrative or privilege 15 credentials.

Exploitation

CVE-2025-20352 was added to CISA KEV on 2025-09-29 with a remediation due date of 2025-10-20, indicating known exploitation; EPSS shows a 30-day probability of roughly 39 percent (98.5th percentile). No ransomware campaign use is documented.

What to do

• Apply the Cisco IOS/IOS XE software updates referenced in the vendor advisory cisco-sa-snmp-x4LPhte as soon as possible.
• If patching is not immediately possible, apply the mitigations in the Cisco advisory or discontinue use of the affected product per CISA BOD 22-01 guidance.
• Restrict SNMP access to trusted management networks and hosts using ACLs and infrastructure ACLs, and disable SNMP where it is not required.
• Rotate SNMP community strings and SNMPv3 credentials, and remove default or widely shared read-only community strings.
• Limit administrative and privilege 15 credentials to the smallest possible set of accounts and devices.

Detection

• Monitor device logs and SNMP traps for unexpected reloads, crashes or restarts of IOS/IOS XE devices.
• Alert on SNMP traffic from hosts outside approved management networks or on anomalous SNMP request patterns and packet sizes.
• Audit SNMP configuration for enabled SNMPv1/v2c community strings and SNMPv3 users, and review authentication logs for use of administrative or privilege 15 accounts.
• Correlate unexpected device reloads with recent SNMP requests to the affected device to identify potential exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.