Skip to content
Patcharo
Back to the results

Vulnerabilities

HighKEV

CVE-2025-20352 — Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

CVE-2025-20352 · Cisco IOS · CVSS 7.7 · KEV

In brief

Severity · CVSS
High7.7CVSS 3.1, High
EPSS
39%
CISA KEV
Known exploited, listed since 29 Sept 2025
Vendor
Cisco
Published · Modified
·
Last verified

Summary

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials. An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. This vulnerability is due to a stack overflow condition in the SNMP subsystem of the affected software. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Note: This vulnerability affects all versions of SNMP.

Weakness: CWE-121

Title, description and the vendor's statements are quoted from the CVE record; a vendor's advisory is summarised in Patcharo's words, with a link.

Affected and fixed versions

Per product and release branch, as the vendor's CVE record and official advisory state them. A fixed release is shown only when a document names it: the vendor's, or CERT-FR's for Check Point, with its source.

52 branches without a precise fixed release

Cisco IOS

Source: CVE-2025-20352cisco-sa-snmp-x4LPhte

  1. 15.9
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  2. 15.8
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  3. 15.7
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  4. 15.6
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  5. 15.5
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  6. 15.4
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  7. 15.3
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  8. 15.2
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  9. 15.1
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  10. 15.0
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed
  11. 12.2
    Affected versionsListed as affected, releases not specified
    First fixed releaseNot published in the sources followed

The vendor states fixes are available; the releases per branch are in its advisory.

Cisco IOS XE Software

Source: CVE-2025-20352cisco-sa-snmp-x4LPhte

  1. 17.18
    Affected versions17.18.1
    First fixed releaseNot published in the sources followed
  2. 17.17
    Affected versions17.17.1
    First fixed releaseNot published in the sources followed
  3. 17.16
    Affected versions17.16.1, 17.16.1a
    First fixed releaseNot published in the sources followed
  4. 17.15
    Affected versions17.15.1, 17.15.1a, 17.15.1b, 17.15.1w
    15 releases listed17.15.1, 17.15.1a, 17.15.1b, 17.15.1w, 17.15.1x, 17.15.1y, 17.15.1z, 17.15.2, 17.15.2a, 17.15.2b, 17.15.2c, 17.15.3, 17.15.3a, 17.15.3b, 17.15.4
    First fixed releaseNot published in the sources followed
  5. 17.14
    Affected versions17.14.1, 17.14.1a
    First fixed releaseNot published in the sources followed
  6. 17.13
    Affected versions17.13.1, 17.13.1a
    First fixed releaseNot published in the sources followed
  7. 17.12
    Affected versions17.12.1, 17.12.1a, 17.12.1w, 17.12.1x
    17 releases listed17.12.1, 17.12.1a, 17.12.1w, 17.12.1x, 17.12.1y, 17.12.1z, 17.12.2, 17.12.2a, 17.12.3, 17.12.3a, 17.12.4, 17.12.4a, 17.12.4b, 17.12.5, 17.12.5a, 17.12.5b, 17.12.5c
    First fixed releaseNot published in the sources followed
  8. 17.11
    Affected versions17.11.1, 17.11.1a
    First fixed releaseNot published in the sources followed
  9. 17.10
    Affected versions17.10.1, 17.10.1a, 17.10.1b
    First fixed releaseNot published in the sources followed
  10. 17.9
    Affected versions17.9.1, 17.9.1a, 17.9.1w, 17.9.1x
    21 releases listed17.9.1, 17.9.1a, 17.9.1w, 17.9.1x, 17.9.1y, 17.9.2, 17.9.2a, 17.9.3, 17.9.3a, 17.9.4, 17.9.4a, 17.9.5, 17.9.5a, 17.9.5b, 17.9.5e, 17.9.5f, 17.9.6, 17.9.6a, 17.9.7, 17.9.7a, 17.9.7b
    First fixed releaseNot published in the sources followed
  11. 17.8
    Affected versions17.8.1, 17.8.1a
    First fixed releaseNot published in the sources followed
  12. 17.7
    Affected versions17.7.1, 17.7.1a, 17.7.1b, 17.7.2
    First fixed releaseNot published in the sources followed
  13. 17.6
    Affected versions17.6.1, 17.6.1a, 17.6.1w, 17.6.1x
    17 releases listed17.6.1, 17.6.1a, 17.6.1w, 17.6.1x, 17.6.1y, 17.6.1z, 17.6.2, 17.6.3, 17.6.3a, 17.6.4, 17.6.5, 17.6.5a, 17.6.6, 17.6.6a, 17.6.7, 17.6.8, 17.6.8a
    First fixed releaseNot published in the sources followed
  14. 17.5
    Affected versions17.5.1, 17.5.1a
    First fixed releaseNot published in the sources followed
  15. 17.4
    Affected versions17.4.1, 17.4.1a, 17.4.1b, 17.4.2
    5 releases listed17.4.1, 17.4.1a, 17.4.1b, 17.4.2, 17.4.2a
    First fixed releaseNot published in the sources followed
  16. 17.3
    Affected versions17.3.1, 17.3.1a, 17.3.1w, 17.3.1x
    19 releases listed17.3.1, 17.3.1a, 17.3.1w, 17.3.1x, 17.3.1z, 17.3.2, 17.3.2a, 17.3.3, 17.3.4, 17.3.4a, 17.3.4b, 17.3.4c, 17.3.5, 17.3.5a, 17.3.5b, 17.3.6, 17.3.7, 17.3.8, 17.3.8a
    First fixed releaseNot published in the sources followed
  17. 17.2
    Affected versions17.2.1, 17.2.1a, 17.2.1r, 17.2.1v
    6 releases listed17.2.1, 17.2.1a, 17.2.1r, 17.2.1v, 17.2.2, 17.2.3
    First fixed releaseNot published in the sources followed
  18. 17.1
    Affected versions17.1.1, 17.1.1a, 17.1.1s, 17.1.1t
    5 releases listed17.1.1, 17.1.1a, 17.1.1s, 17.1.1t, 17.1.3
    First fixed releaseNot published in the sources followed
  19. 16.12
    Affected versions16.12.1, 16.12.1a, 16.12.1c, 16.12.1s
    29 releases listed16.12.1, 16.12.1a, 16.12.1c, 16.12.1s, 16.12.1t, 16.12.1w, 16.12.1x, 16.12.1y, 16.12.2, 16.12.2a, 16.12.2s, 16.12.3, 16.12.3a, 16.12.3s, 16.12.4, 16.12.4a, 16.12.5, 16.12.5a, 16.12.5b, 16.12.6, 16.12.6a, 16.12.7, 16.12.8, 16.12.9, 16.12.10, 16.12.10a, 16.12.11, 16.12.12, 16.12.13
    First fixed releaseNot published in the sources followed
  20. 16.11
    Affected versions16.11.1, 16.11.1a, 16.11.1b, 16.11.1s
    5 releases listed16.11.1, 16.11.1a, 16.11.1b, 16.11.1s, 16.11.2
    First fixed releaseNot published in the sources followed
  21. 16.10
    Affected versions16.10.1, 16.10.1a, 16.10.1b, 16.10.1c
    11 releases listed16.10.1, 16.10.1a, 16.10.1b, 16.10.1c, 16.10.1d, 16.10.1e, 16.10.1f, 16.10.1g, 16.10.1s, 16.10.2, 16.10.3
    First fixed releaseNot published in the sources followed
  22. 16.9
    Affected versions16.9.1, 16.9.1a, 16.9.1b, 16.9.1s
    13 releases listed16.9.1, 16.9.1a, 16.9.1b, 16.9.1s, 16.9.2, 16.9.3, 16.9.3a, 16.9.4, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8
    First fixed releaseNot published in the sources followed
  23. 16.8
    Affected versions16.8.1, 16.8.1a, 16.8.1b, 16.8.1c
    9 releases listed16.8.1, 16.8.1a, 16.8.1b, 16.8.1c, 16.8.1d, 16.8.1e, 16.8.1s, 16.8.2, 16.8.3
    First fixed releaseNot published in the sources followed
  24. 16.7
    Affected versions16.7.1, 16.7.1a, 16.7.1b, 16.7.2
    6 releases listed16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4
    First fixed releaseNot published in the sources followed
  25. 16.6
    Affected versions16.6.1, 16.6.2, 16.6.3, 16.6.4
    12 releases listed16.6.1, 16.6.2, 16.6.3, 16.6.4, 16.6.4a, 16.6.5, 16.6.5a, 16.6.6, 16.6.7, 16.6.8, 16.6.9, 16.6.10
    First fixed releaseNot published in the sources followed
  26. 3.18
    Affected versions3.18s, 3.18.1s, 3.18.2s, 3.18.3s
    5 releases listed3.18s, 3.18.1s, 3.18.2s, 3.18.3s, 3.18.4s
    First fixed releaseNot published in the sources followed
  27. 3.17
    Affected versions3.17s, 3.17.1s, 3.17.2s, 3.17.3s
    5 releases listed3.17s, 3.17.1s, 3.17.2s, 3.17.3s, 3.17.4s
    First fixed releaseNot published in the sources followed
  28. 3.16
    Affected versions3.16s, 3.16.1s, 3.16.2s, 3.16.3s
    11 releases listed3.16s, 3.16.1s, 3.16.2s, 3.16.3s, 3.16.4s, 3.16.5s, 3.16.6s, 3.16.7s, 3.16.8s, 3.16.9s, 3.16.10s
    First fixed releaseNot published in the sources followed
  29. 3.15
    Affected versions3.15s, 3.15.1s, 3.15.2s, 3.15.3s
    5 releases listed3.15s, 3.15.1s, 3.15.2s, 3.15.3s, 3.15.4s
    First fixed releaseNot published in the sources followed
  30. 3.14
    Affected versions3.14s, 3.14.1s, 3.14.2s, 3.14.3s
    5 releases listed3.14s, 3.14.1s, 3.14.2s, 3.14.3s, 3.14.4s
    First fixed releaseNot published in the sources followed
  31. 3.11
    Affected versions3.11e, 3.11.1e, 3.11.2e, 3.11.3e
    13 releases listed3.11e, 3.11.1e, 3.11.2e, 3.11.3e, 3.11.4e, 3.11.5e, 3.11.6e, 3.11.7e, 3.11.8e, 3.11.9e, 3.11.10e, 3.11.11e, 3.11.12e
    First fixed releaseNot published in the sources followed
  32. 3.10
    Affected versions3.10e, 3.10.1e, 3.10.2e, 3.10.3e
    First fixed releaseNot published in the sources followed
  33. 3.9
    Affected versions3.9e, 3.9.1e, 3.9.2e
    First fixed releaseNot published in the sources followed
  34. 3.8
    Affected versions3.8e, 3.8.1e, 3.8.2e, 3.8.3e
    11 releases listed3.8e, 3.8.1e, 3.8.2e, 3.8.3e, 3.8.4e, 3.8.5e, 3.8.6e, 3.8.7e, 3.8.8e, 3.8.9e, 3.8.10e
    First fixed releaseNot published in the sources followed
  35. 3.7
    Affected versions3.7e, 3.7.1e, 3.7.2e, 3.7.3e
    6 releases listed3.7e, 3.7.1e, 3.7.2e, 3.7.3e, 3.7.4e, 3.7.5e
    First fixed releaseNot published in the sources followed
  36. 3.6
    Affected versions3.6e, 3.6.1e, 3.6.2e, 3.6.3e
    11 releases listed3.6e, 3.6.1e, 3.6.2e, 3.6.3e, 3.6.4e, 3.6.5e, 3.6.6e, 3.6.7e, 3.6.8e, 3.6.9e, 3.6.10e
    First fixed releaseNot published in the sources followed
  37. 3.5
    Affected versions3.5e, 3.5.1e, 3.5.2e, 3.5.3e
    First fixed releaseNot published in the sources followed

The vendor states fixes are available; the releases per branch are in its advisory.

Cisco IOS XE Catalyst SD-WAN

Source: CVE-2025-20352cisco-sa-snmp-x4LPhte

  1. 16.12
    Affected versions16.12.1b, 16.12.1d, 16.12.1e, 16.12.2r
    8 releases listed16.12.1b, 16.12.1d, 16.12.1e, 16.12.2r, 16.12.3, 16.12.4, 16.12.4a, 16.12.5
    First fixed releaseNot published in the sources followed
  2. 16.11
    Affected versions16.11.1a
    First fixed releaseNot published in the sources followed
  3. 16.10
    Affected versions16.10.1, 16.10.2, 16.10.3, 16.10.3a
    8 releases listed16.10.1, 16.10.2, 16.10.3, 16.10.3a, 16.10.3b, 16.10.4, 16.10.5, 16.10.6
    First fixed releaseNot published in the sources followed
  4. 16.9
    Affected versions16.9.1, 16.9.2, 16.9.3, 16.9.4
    First fixed releaseNot published in the sources followed

The vendor states fixes are available; the releases per branch are in its advisory.

Remediation

Fix available

Vendor fix

Cisco has released updates that fix this vulnerability; its advisory lists them.

SourceCisco Security Advisory cisco-sa-snmp-x4LPhte· revised 6 Oct 2025

Mitigation (vendor)

Cisco describes a workaround or a mitigation in its advisory.

SourceCisco Security Advisory cisco-sa-snmp-x4LPhte

CISA KEV required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date:

SourceCISA KEV

CERT-FR recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).

SourceCERTFR-2025-AVI-0818

Last verified 1 Oct 2026 at 09:32 UTC

Known exploitation

Added to CISA KEV on 29 Sept 2025

Federal remediation due date: 20 Oct 2025

The CISA required action is shown under Remediation.

39% probability of exploitation in the next 30 days (percentile 99%).

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CERT-FR

1 document of the French national CERT (ANSSI) references this CVE.

Advisory (AVI)CERTFR-2025-AVI-0818Published 25 Sept 2025

Multiple vulnerabilities in Cisco IOS and IOS XE

Remote denial of serviceRemote arbitrary code executionSecurity policy bypass

Summary

Multiple vulnerabilities have been discovered in Cisco IOS and IOS XE. They allow an attacker to cause remote arbitrary code execution, remote denial of service, and security policy bypass. Cisco indicates that vulnerability CVE-2025-20352 is actively exploited.

Recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).

Official document on cert.ssi.gouv.frread by Patcharo 28 Sept 2026 at 20:04 UTCMachine translation of the French text published by CERT-FR; a text whose translation did not pass Patcharo's checks stays in French. Identifiers, versions and links are copied unchanged.

Timeline

  1. Published by the source
  2. Added to CISA KEV
  3. CISA remediation due date
  4. Source record last modified
  5. EPSS score computed
  6. Last verified by Patcharo

Official sources

References

Cisco · CISA Known Exploited Vulnerabilities · NVD · FIRST EPSS · Cisco Security Advisory cisco-sa-snmp-x4LPhte

How Patcharo reads this

Affected and fixed releases come from the vendor's structured statements and are matched against exact versions; CVSS from NVD, exploitation from CISA KEV and the vendor's own advisory, probability from FIRST EPSS. Missing data stays Unknown and never becomes Not affected.

Read the methodologyRead the guide: Cisco Secure Firewall release trains: Threat Defense, Management Center and ASA versions explained