Product:
Cisco IOS Software and Cisco IOS XE Software
Summary
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem could allow an authenticated, remote attacker to cause a denial of service (DoS) condition or execute code as the root user on affected devices. Low-privileged attackers can cause a DoS, while high-privileged attackers can gain full control. This vulnerability is due to a stack overflow condition in the SNMP subsystem.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.7 | CVE-2025-20352 |
Exploitation
An attacker can exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. The attacker must have the appropriate SNMP community string or valid SNMPv3 user credentials. A successful exploit could lead to a system reload, resulting in a DoS condition, or allow arbitrary code execution with root privileges.
Affected Products
- All versions of Cisco IOS Software
- All versions of Cisco IOS XE Software
Mitigation
To mitigate this vulnerability, it is recommended to restrict SNMP access to trusted hosts and networks. Additionally, ensure that SNMP community strings are complex and not easily guessable. Regularly update the software to the latest versions to incorporate security patches.