Vulnerability in Cisco devices actively exploited
On September 24, 2025, Cisco released security updates for a vulnerability in Cisco IOS and IOS XE Software. The vulnerability CVE-2025-20352 is currently being actively exploited on unpatched systems.
T-Update
This live blog contains information about the vulnerability in Cisco IOS and IOS XE Software (CVE-2025-20352). Cisco has released security updates to address this vulnerability. Threat actors can exploit the vulnerability for Denial of Service and potentially for executing arbitrary code on vulnerable systems. Last update on September 25, 2025.
Background
CVE-2025-20352 is a critical vulnerability in the SNMP subsystem of Cisco IOS and IOS XE Software that could allow attackers to compromise affected Cisco devices. This vulnerability affects all versions of SNMP (v1, v2c, and v3). The vulnerability is currently being actively exploited.
Risk
Systems using SNMPv1 or SNMPv2, directly connected to the internet, whose default community strings have not been modified, are highly likely to be successfully attacked, allowing attackers to take full control of the system. These systems must be patched immediately.
Systems using SNMPv3, whose community strings have been modified, or that are not directly connected to the internet are slightly less at risk but should also be patched as soon as possible.
More than 2 million Cisco devices are potentially vulnerable and exposed to the internet via SNMP, nearly 32,000 of which are in the Netherlands.
Advice
Cisco has released software updates that address this vulnerability. No workarounds are available. Organizations are advised to upgrade to a patched version as soon as possible, as described in Cisco's advisory.
In addition, it is possible to disable the specific Object IDs affected by this vulnerability, but this may also impact SNMP functionality. This is also described in Cisco's advisory.
Furthermore, it is recommended to:
- Switch to SNMPv3, which is generally more secure than v1 and v2.
- Restrict SNMP access to trusted networks.
- Avoid using default community strings when using SNMPv1 and SNMPv2.
Sign up to receive T-Updates
Receive the latest vulnerabilities in your email every Wednesday
More than 1,000 organisations have already joined us.
