# cisco situation keeps getting worse

Source: https://www.youtube.com/watch?v=ik9b5jRhwFA
Recap page: https://rapidrecap.app/video/ik9b5jRhwFA
Generated: 2025-10-06T17:03:15.562+00:00

---
## Quick Overview

Cisco is facing escalating security issues as new critical vulnerabilities, including a stack-based buffer overflow in SNMP affecting Cisco IOS and IOS XE devices (CVE-2025-20352, CVSS 9.9) and a Remote Code Execution vulnerability in their VPN Web Server (CVSS 9.9), are being actively exploited in attacks, mirroring the risk posed by older, similar SNMP bugs from 2017, forcing users to apply mitigations like disabling SNMP or implementing specific configuration changes.

**Key Points:**
- Cisco uncovered a critical SNMP vulnerability (CVE-2025-20352, CVSS 9.9) in Cisco IOS and IOS XE that allows authenticated remote attackers to achieve arbitrary code execution with root privileges.
- A second critical vulnerability (CVSS 9.9) exists in the Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense VPN Web Server, allowing remote code execution.
- Both vulnerabilities are reportedly being actively exploited, with the SNMP flaw being related to older, known-exploited SNMP stack vulnerabilities from 2017 (e.g., CVE-2017-6741).
- The SNMP vulnerability is exploitable via crafted SNMP packets (UDP port 161) and requires the attacker to know valid SNMP credentials (v1, v2c, or v3).
- Mitigation for the SNMP flaw involves configuring a view to exclude vulnerable OIDs, specifically listing several Cisco-related MIBs to be excluded, like CISCO-AUTH-FRAMEWORK-MIB.
- The presenter highlights that the iOS/IOS XE vulnerability affects devices running Linux-based kernels, unlike the proprietary OS versions.
- The speaker shows a Python exploit script demonstrating how OID strings are parsed into binary data for the attack payload.

![Screenshot at 0:04: The presenter displays the CyberScoop headline announcing 'Cisco uncovers new SNMP vulnerability used in attacks on IOS devices,' setting the stage for the discussion on recent Cisco security flaws.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-00-04.png)

**Context:** The video discusses recent, critical security vulnerabilities disclosed by Cisco, focusing on two main issues: a new vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE software, and a separate Remote Code Execution flaw in their VPN Web Server component. The presenter analyzes the severity of these flaws, referencing the CVSS scores and the fact that they are already being exploited in the wild, drawing parallels to historical SNMP-related exploits.

## Detailed Analysis

The video details two significant, recently disclosed Cisco vulnerabilities that are already seeing active exploitation. The first, CVE-2025-20352, affects the SNMP subsystem in Cisco IOS and IOS XE Software, rated as Critical with a CVSS score of 9.9. This stack-based buffer overflow allows an authenticated, remote attacker with low privileges to force a system reload (Denial of Service) or execute arbitrary code with root-level permissions if they possess valid SNMP credentials (v1, v2c, or v3). The presenter notes this mirrors older, widely exploited SNMP bugs from 2017. The second critical vulnerability, also rated 9.9, affects the VPN Web Server on Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software, allowing authenticated remote attackers to execute arbitrary code as root via crafted HTTP requests. The presenter connects this to the risk of bypassing authentication if an attacker already has VPN credentials. Mitigation for the SNMP flaw involves using CLI commands to create a view that explicitly excludes vulnerable OIDs, such as excluding the CISCO-AUTH-FRAMEWORK-MIB and the cafSessionMethodsInfoEntry. The speaker also reviews the components of SNMP and notes that the IOS XE vulnerabilities are concerning because they run on Linux-based kernels, unlike some other Cisco OS versions. Finally, the presenter shows a proof-of-concept Python script utilizing the vulnerable OID string to structure the attack payload.

### Cisco Vulnerability Summary

- CVE-2025-20352 (SNMP RCE on IOS/IOS XE) rated High/Critical (9.9 CVSS)
- Second vulnerability in Secure Firewall VPN Web Server (9.9 CVSS)
- Both flaws are reportedly being actively exploited.

### SNMP Vulnerability Details

- Stack-based buffer overflow in SNMP subsystem requiring authenticated access via SNMPv1/v2c/v3 credentials
- Exploitation allows root access and RCE, or DoS.

### Historical Context

- The current SNMP bug is similar to older exploits from 2017, showing a recurring pattern in Cisco's management protocol security.

### SNMP Protocol Overview

- SNMP utilizes five components (Manager, Managed Devices, Agent, MIB, OID) to manage network devices over UDP port 161.

### Mitigation for SNMP Flaws

- Cisco recommends updating to fixed software or implementing CLI commands to exclude vulnerable OIDs, such as using 'snmp-server view NO_BAD_SNMP cafSessionMethodsInfoEntry excluded'.

### Cisco IOS Context

- The affected IOS XE devices use a Linux-based kernel, contrasting with other Cisco OS versions that run proprietary code, making the exploit potentially harder to write for bare-metal access.

### Sponsor Plug

- Flare is mentioned as a threat exposure management platform that monitors for company identifiers being sold online, with a link provided for a free trial.

![Screenshot at 0:04: The presenter highlights an article confirming Cisco uncovered a new SNMP vulnerability used in attacks on IOS devices.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-00-04.png)
![Screenshot at 0:04: Cisco Security Advisory showing CVE-2025-20333 on Secure Firewall VPN Web Server, rated Critical with a CVSS score of 9.9.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-00-04.png)
![Screenshot at 0:07: Cisco Security Advisory for CVE-2025-20352 on IOS and IOS XE, rated High with a CVSS score of 7.7, detailing Denial of Service and Remote Code Execution.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-00-07.png)
![Screenshot at 0:30: A Fortinet article defining the Simple Network Management Protocol \(SNMP\) overview, which is central to the first vulnerability discussed.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-00-30.png)
![Screenshot at 1:31: The presenter displays a GitHub repository containing a Python script \('c2800nm-adventerprisek9-mz.151-4.M12a.py'\) used to exploit the SNMP vulnerability.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-01-31.png)
![Screenshot at 2:22: A Cisco advisory listing several vulnerable MIBs that must be queried by the attacker, including CISCO-AUTH-FRAMEWORK-MIB.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-02-22.png)
![Screenshot at 4:30: The presenter displays a call-to-action link for the sponsor, Flare, which offers threat exposure management.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-04-30.png)
![Screenshot at 5:06: Cisco CLI commands demonstrating the mitigation strategy by excluding specific OIDs like 'cafSessionMethodsInfoEntry' using the 'snmp-server view' command.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-05-06.png)
![Screenshot at 8:34: The presenter holds up a small red circuit board while discussing the difference between embedded Rust code and proprietary OS kernels.](https://ss.rapidrecap.app/screens/ik9b5jRhwFA/00-08-34.png)