cisco situation keeps getting worse

Quick Overview

Cisco is facing escalating security issues as new critical vulnerabilities, including a stack-based buffer overflow in SNMP affecting Cisco IOS and IOS XE devices (CVE-2025-20352, CVSS 9.9) and a Remote Code Execution vulnerability in their VPN Web Server (CVSS 9.9), are being actively exploited in attacks, mirroring the risk posed by older, similar SNMP bugs from 2017, forcing users to apply mitigations like disabling SNMP or implementing specific configuration changes.

Key Points: Cisco uncovered a critical SNMP vulnerability (CVE-2025-20352, CVSS 9.9) in Cisco IOS and IOS XE that allows authenticated remote attackers to achieve arbitrary code execution with root privileges. A second critical vulnerability (CVSS 9.9) exists in the Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense VPN Web Server, allowing remote code execution. Both vulnerabilities are reportedly being actively exploited, with the SNMP flaw being related to older, known-exploited SNMP stack vulnerabilities from 2017 (e.g., CVE-2017-6741). The SNMP vulnerability is exploitable via crafted SNMP packets (UDP port 161) and requires the attacker to know valid SNMP credentials (v1, v2c, or v3). Mitigation for the SNMP flaw involves configuring a view to exclude vulnerable OIDs, specifically listing several Cisco-related MIBs to be excluded, like CISCO-AUTH-FRAMEWORK-MIB. The presenter highlights that the iOS/IOS XE vulnerability affects devices running Linux-based kernels, unlike the proprietary OS versions. The speaker shows a Python exploit script demonstrating how OID strings are parsed into binary data for the attack payload.

Context: The video discusses recent, critical security vulnerabilities disclosed by Cisco, focusing on two main issues: a new vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE software, and a separate Remote Code Execution flaw in their VPN Web Server component. The presenter analyzes the severity of these flaws, referencing the CVSS scores and the fact that they are already being exploited in the wild, drawing parallels to historical SNMP-related exploits.