Stratix stack overflow enables authenticated remote code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Authenticated SNMP packet to Rockwell Automation Stratix switches causes DoS or arbitrary code execution; update or isolate.
Rockwell Automation Stratix 5700, 5400, 5410, 5200, and 5800 switches contain a stack-based buffer overflow (CVE-2025-20352) in the SNMP subsystem inherited from Cisco IOS XE Software. An authenticated remote attacker with low privileges can send a crafted SNMP packet to cause denial of service by reloading the device. An attacker with higher privileges (SNMPv1/v2c read-only community string or SNMPv3 credentials plus administrative or privilege-15 credentials) can execute arbitrary code as root, gaining full control. The vulnerability requires network access and valid SNMP credentials, but the attack complexity is low and exploitability is remote. CVSS v4 score is 6.3.
Affected versions: Stratix 5700, 5400, 5410 at v15.2(8)E7 and prior; Stratix 5200, 5800 at v17.17.01 and prior. CISA reports no known public exploitation at the time of this advisory. The attack surface is primarily organizations that expose SNMP to untrusted networks or allow remote access with weak authentication. Defenders should prioritize patching, enforce network segmentation, disable or restrict SNMP access, and monitor for unexpected device reloads or SNMP anomalies.
Mentioned in this report
Detection guidance
SNMP Request From Non-Private Source Address to Internal Device
Detects SNMP (UDP/161) traffic from a public source address to an internal host. Exposed SNMP is the attack surface for the Stratix/IOS XE SNMP stack overflow (CVE-2025-20352). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SNMP Request From Non-Private Source Address to Internal Device
description: Detects SNMP queries (destination port 161) originating from non-RFC1918/non-local
source addresses toward internal devices. The Stratix/IOS XE SNMP stack overflow
(CVE-2025-20352) is reachable only via SNMP with valid credentials, so SNMP from
untrusted networks is the exposure that enables exploitation.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: firewall
detection:
selection:
dst_port: 161
filter_private_src:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private_src
falsepositives:
- Legitimate external network monitoring providers polling devices over SNMP
- Partner or MSP management networks using public address space
level: medium
id: 3f2f16cf-f512-526f-8bb9-46a60af2f136
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-03
Cisco IOS XE Device Reload or Restart Logged
Detects reload/restart syslog messages from Cisco IOS/IOS XE based switches, which may indicate a crashed device from SNMP overflow exploitation (DoS outcome). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco IOS XE Device Reload or Restart Logged description: Detects reload or restart messages in Cisco IOS/IOS XE syslog. An unexpected reload outside a change window is the documented denial-of-service outcome of the SNMP stack overflow CVE-2025-20352 and should be correlated with prior SNMP activity. tags: - attack.initial-access - attack.t1190 logsource: product: cisco service: syslog detection: keywords: - '%SYS-5-RELOAD' - '%SYS-5-RESTART' - Reload requested condition: keywords falsepositives: - Planned reloads during maintenance windows or firmware upgrades - Power events causing switch restarts level: low id: 92e17fac-8d4d-5418-8575-ee653c81d94d status: experimental author: Vorant references: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-03
Cisco Device SNMP Authentication Failure
Detects SNMP authentication failure syslog messages on Cisco IOS/IOS XE devices, indicating community string or credential guessing before exploiting SNMP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Device SNMP Authentication Failure description: Detects SNMP authentication failure messages on Cisco IOS/IOS XE based devices. Exploiting CVE-2025-20352 needs valid SNMP community strings or SNMPv3 credentials, so repeated failures from one host suggest credential guessing. Alert on repeated occurrences from the same source over a short period. tags: - attack.initial-access - attack.t1190 logsource: product: cisco service: syslog detection: keywords: - '%SNMP-3-AUTHFAIL' - Authentication failure for SNMP req condition: keywords falsepositives: - Misconfigured network monitoring systems using a wrong community string - Decommissioned monitoring servers still polling devices level: medium id: d4dd2f78-c02e-57fd-9146-068625942f9e status: experimental author: Vorant references: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-03
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs