DaystoPatch

CiscoExploited incident

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

CVE-2025-20352High, CVSS 7.7In CISA's Known Exploited Vulnerabilities catalog since 29 Sep 2025

  • Exploited before a fix
FixedFirst fix under an hour after the first public report. No evidence yet of when every version was fixed.

Response

Silence
0h
First public report to first vendor statement
Exposure
<1h
First public report to first fix
Follow-through
not dated
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-snmp-x4LPhteClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b3ff3bb9a68688a…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Cisco advisory cisco-sa-snmp-x4LPhteClaimedQuote verified24 Sep 2025, 16:00 UTC

    Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:18361dd7ff5357b4…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-snmp-x4LPhte, v1.0 (Wayback snapshot 2025-09-25)CuratedQuote verified24 Sep 2025, 16:00 UTC

    The Cisco Product Security Incident Response Team (PSIRT) became aware of successful exploitation of this vulnerability in the wild after local Administrator credentials were compromised.

    Exploitation disclosed in v1.0 ('First Published: 2025 September 24 16:00 GMT'; CSAF 1.0.0 at 2025-09-24T15:58:32+00:00). No earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b40614436aa43080…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet24 Sep 2025, 17:07 UTC

    Ciscoは、現在攻撃で悪用されているCisco IOSおよびIOS XEソフトウェアの重大度の高いゼロデイ脆弱性に対処するためのセキュリティアップデートを公開しました。 CVE-2025-20352として追跡されているこの脆弱性は、脆弱なIOSおよびIOS XEソフトウェアのSimple Network Management Protocol（SNMP）サブシステムに存在するスタックベースのバッファオーバーフローの弱点が原因であり、SNMPが有効になっているすべてのデバイスに影響します。

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-20352ClaimedQuote verified24 Sep 2025, 17:10 UTC

    A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fe035597c8a20041…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet24 Sep 2025, 17:15 UTC

    Cisco's SNMP zero-day vulnerability (CVE-2025-20352) could let hackers take complete control of critical networks with just low-level access. How vulnerable is your network? https:// thedefendopsdiaries.com/cve-20

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-20352)ClaimedQuote verified29 Sep 2025

    Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

    Added to CISA's KEV catalog on 2025-09-29.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-snmp-x4LPhteClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b3ff3bb9a68688a…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-snmp-x4LPhteCuratedQuote not checked yet24 Sep 2025, 16:00 UTC

    First Published: 2025 September 24 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    +<1h

    Cisco PSIRT advisory cisco-sa-snmp-x4LPhte, v1.0 (Wayback snapshot 2025-09-25)CuratedQuote verified

    Administrators are advised to allow only trusted users to have SNMP access on an affected system.

    v1.0 mitigation: restrict SNMP access and exclude the affected OIDs with an SNMP view. The CLI examples were corrected in revisions 2.1 (2025-09-30) and 2.2 (CSAF 2025-10-02; the HTML table shows 2025-OCT-06).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b40614436aa43080…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    +<1h

    Cisco PSIRT advisory cisco-sa-snmp-x4LPhte, v1.0 (Wayback snapshot 2025-09-25)CuratedQuote verified

    Cisco has released software updates that addresses this vulnerability. There are no workarounds that address this vulnerability. There is a mitigation that addresses this vulnerability.

    Fixed releases are given only through the Cisco Software Checker, not a table in the advisory.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b40614436aa43080…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

This advisory changed after publication

  1. cisco-sa-snmp-x4LPhte

    Recorded in the revision history

    Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

    Revision 2.2 date changed from 2025-10-02 to 2025-10-06.

    • Revision date changed
    Revision 2.2 date
    Before2025-10-02
    After2025-10-06
    Earlier version captured 3 Oct 2025, 14:24 UTC: archived copyLater version captured 7 Oct 2025, 17:11 UTC: archived copyRecovered from archived copiesSnapshots 986c4afff7… and 71202269f3…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco IOS Software
  • Cisco IOS XE Software
  • Meraki cloud-managed switches running an affected IOS XE release
How we built this timeline

Zero-day at disclosure: Cisco said it was aware of successful exploitation (after local administrator credentials were compromised) when it published fixes. Fixed for all versions is omitted and status is 'unknown': the advisory points to the Cisco Software Checker and gives no per-train fixed releases or dates, and a sentence added after v1.0 (not in the 25 Sep 2025 snapshot; current page, after the Meraki note added in revision 2.3 on 6 Oct 2025) says 'Using this configuration is recommended until fixed software becomes available.', so some devices (apparently Meraki cloud-managed switches) lacked fixed software in October 2025 and we cannot confirm when that ended.

Revision 2.0 (CSAF 2025-09-26T16:35:48+00:00) 'Updated affected products.' Found during the resolution of a Cisco TAC support case. Severity follows the CVSS base score 7.7 (high).

Related

Cisco report card