Critical Zero-Day Exploit Targets 2 Million Cisco Devices, Leaving Them Vulnerable to Remote Attacks

As Many as 2 Million Cisco Devices Affected by Actively Exploited Zero-Day A critical vulnerability affecting up to 2 million Cisco devices has been discovered, allowing attackers to remotely crash or execute code on vulnerable systems. The zero-day exploit, tracked as CVE-2025-20352, was identified in all supported versions of Cisco IOS and Cisco IOS XE operating systems. According to a Wednesday advisory from the Cisco Product Security Incident Response Team (PSIRT), the vulnerability can be exploited by low-privileged users to create a denial-of-service attack or by higher-privileged users to execute code with unfettered root privileges. The severity rating for this vulnerability is 7.7 out of a possible 10. "We strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability," said Cisco's PSIRT team in the advisory. "Exposing SNMP to the Internet can lead to exploitation, so it's essential to take immediate action." The vulnerability was discovered after local Administrator credentials were compromised, allowing attackers to successfully exploit the zero-day. This incident highlights the importance of robust security measures and regular software updates. Cisco's operating systems power a wide variety of networking devices, including routers and switches. The affected devices are likely used in various industries, including finance, healthcare, and government. "This vulnerability is a stark reminder of the need for robust cybersecurity practices," said Dr. Maria Rodriguez, a cybersecurity expert at Stanford University. "It's essential for organizations to prioritize security updates and patching to prevent such attacks." The discovery of this zero-day exploit has significant implications for society, as it can compromise sensitive data and disrupt critical infrastructure. Cisco has released fixed software releases to address the vulnerability, and customers are advised to upgrade their systems immediately. The company is also working with its partners to provide additional support and guidance. As the cybersecurity landscape continues to evolve, this incident serves as a reminder of the importance of proactive security measures and regular updates. *Reporting by Arstechnica.*