Cisco IOS and IOS XE Software Vulnerabilities Let Attackers Execute Remote Code
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Cisco has disclosed a severe vulnerability in its widely used IOS and IOS XE Software, potentially allowing attackers to crash devices or seize full control through remote code execution.<\/p>\n
The flaw, rooted in the Simple Network Management Protocol (SNMP)<\/a> subsystem, stems from a stack overflow condition that attackers can trigger with a specially crafted SNMP packet over IPv4 or IPv6 networks.<\/p>\n This issue affects all SNMP versions and has already seen exploitation in the wild, highlighting the urgency for network administrators to act swiftly.<\/p>\n The vulnerability enables two main attack vectors. A low-privileged, authenticated remote attacker armed with SNMPv2c read-only community strings or valid SNMPv3 credentials could induce a denial-of-service (DoS)<\/a> condition, forcing affected devices to reload and disrupting network operations.<\/p>\n More alarmingly, a highly privileged attacker with administrative or privilege level 15 access could execute arbitrary code as the root user on IOS XE devices, granting complete system takeover.<\/p>\n Cisco\u2019s Product Security Incident Response Team (PSIRT) discovered this during a Technical Assistance Center support case, and real-world exploits followed compromised local administrator credentials.<\/p>\n This flaw impacts a broad range of Cisco devices running vulnerable IOS or IOS XE releases with SNMP enabled, including routers, switches, and access points essential to enterprise infrastructures.<\/p>\n Devices that haven\u2019t explicitly excluded the affected object ID (OID) remain at risk. Notably, IOS XR Software and NX-OS Software are unaffected, providing some relief for users of those platforms.<\/p>\n The potential fallout is significant: DoS attacks could halt critical services, while root-level code execution might enable data theft, lateral movement in networks, or deployment of malware.<\/p>\n Given SNMP\u2019s ubiquity for device monitoring, many organizations unwittingly expose themselves by leaving default configurations intact.<\/p>\n Cisco emphasizes<\/a> that no full workarounds exist, but mitigations can curb immediate threats. Administrators should restrict SNMP access to trusted users only and monitor via the \u201cshow snmp host\u201d CLI command.<\/p>\n A key step involves disabling vulnerable OIDs using the \u201csnmp-server view\u201d command to create a restricted view, then applying it to community strings or SNMPv3 groups. For Meraki cloud-managed switches, contacting support is advised to implement these changes.<\/p>\n Patches are now available through Cisco\u2019s September 2025 Semiannual Security Advisory Bundled Publication. Users can verify exposure and find fixed releases using the Cisco Software Checker tool<\/a>.<\/p>\n To check SNMP status, run CLI commands like \u201cshow running-config | include snmp-server community\u201d for v1\/v2c or \u201cshow snmp user\u201d for v3.<\/p>\n Cisco urges immediate upgrades to fortified software, warning that delays could invite further exploits. As networks grow more interconnected, such vulnerabilities underscore the need for rigorous SNMP hardening and proactive patching.<\/p>\n Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n The post Cisco IOS and IOS XE Software Vulnerabilities Let Attackers Execute Remote Code<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nMitigations<\/strong><\/h2>\n