Skip to content
Fencer Vulns
high 7.7

CVE-2025-20352 kev in the critical feed json

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the…

published 2025-09-24 13 mo ago modified 2026-09-26 44 d ago also EUVD-2025-31023

cvss
7.7
version 3.1, CNA
cisa kev
Exploited
added 2025-09-29
epss
40.6%
EPSS 40.6% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials. An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. This vulnerability is due to a stack overflow condition in the SNMP subsystem of the affected software. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Note: This vulnerability affects all versions of SNMP.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-282-02 updated cvss 7.7

Rockwell Automation Lifecycle Services with Cisco

  • Rockwell Automation Firewall-Managed Support contract with Cisco firewall Rockwell Automation IDC-Managed Support contract with Cisco Switching >=Generations_1, <=5 Rockwell Automation Industrial Data Center (IDC) with Cisco Switching >=Generations_1, <=5 Rockwell Automation Network-Managed Support contract with Cisco network switch
    affected: mitigation “Rockwell Automation recommends users take the following actions based on their situation.” sec.cloudapps.cisco.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-25-282-03 updated cvss 7.7

Rockwell Automation Stratix

  • Rockwell Automation Stratix 5200 <=v17.17.01 Rockwell Automation Stratix 5400 <=v15.28E7 Rockwell Automation Stratix 5410 <=v15.28E7 Rockwell Automation Stratix 5700 <=v15.28E7 Rockwell Automation Stratix 5800 <=v17.17.01
    affected: mitigation “Rockwell Automation recommends users of the affected Stratix software implement workarounds from Cisco and our security best practices.” sec.cloudapps.cisco.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. Published
  2. CISA SSVC: exploitation active
  3. Added to CISA KEV
  4. CISA patch deadline

Known exploited

Added
13 mo ago
Patch by
2025-10-20 (12 mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
Cisco, IOS and IOS XE
CISA name
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
13 mo ago

Exploit prediction

40.58% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

  • Cisco IOS
  • Cisco Cisco IOS XE Software
  • Cisco Cisco IOS XE Catalyst SD-WAN

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.