Rockwell Automation IDC SNMP stack overflow allows root code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Stack buffer overflow in Cisco IOS XE SNMP affects Rockwell Automation Lifecycle Services; authenticated remote attacker with high privileges can execute code.
Rockwell Automation Lifecycle Services products that incorporate Cisco IOS XE Software contain a stack-based buffer overflow vulnerability (CVE-2025-20352) in the SNMP subsystem. The vulnerability affects Industrial Data Center (IDC) with Cisco Switching (Generations 1-5), IDC-Managed Support contracts with Cisco Switching (Generations 1-5), Network-Managed Support contracts with Cisco network switches (all versions), and Firewall-Managed Support contracts with Cisco firewalls (all versions).
An authenticated remote attacker with low privileges and a valid SNMPv2c or earlier read-only community string or SNMPv3 credentials can cause a denial-of-service condition by sending a crafted SNMP packet. An authenticated attacker with high privileges holding SNMPv1/v2c read-only community strings or SNMPv3 credentials plus administrative or privilege level 15 credentials can execute arbitrary code as root and achieve full system control. The attack is remotely exploitable over IPv4 or IPv6 with low attack complexity.
CISA reports no known public exploitation in the wild as of October 2025. Rockwell Automation customers with active managed service contracts should contact the vendor for remediation guidance. All others should apply Cisco's workarounds and network segmentation controls to restrict device accessibility and isolate control system networks behind firewalls.
Mentioned in this report
Detection guidance
Cisco IOS XE SNMP Authentication Failure Burst Indicative of Community String Guessing
Cisco device syslog SNMP-3-AUTHFAIL events, which show attempts with invalid SNMP community strings or credentials, a prerequisite for CVE-2025-20352 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco IOS XE SNMP Authentication Failure Burst Indicative of Community String Guessing description: Detects Cisco IOS/IOS XE syslog SNMP authentication failure messages (SNMP-3-AUTHFAIL). CVE-2025-20352 exploitation requires a valid read-only community string or SNMPv3 credentials, so guessing or default strings (public/private) precede it. Alert on repeated hits from the same source within a short window; the threshold is applied in the SIEM, not in this rule. tags: - attack.initial-access - attack.t1078.001 - attack.t1190 logsource: product: cisco service: syslog detection: keywords: - '%SNMP-3-AUTHFAIL' - Authentication failure for SNMP request condition: keywords falsepositives: - Network monitoring systems polling with a stale or misconfigured community string - Vulnerability scanners run by the internal security team level: medium id: e9cc941d-acfc-5c40-b302-1e591a8dfbcf status: experimental author: Vorant references: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-02
Cisco IOS XE SNMP Engine Process Fault or Traceback
Cisco syslog showing a traceback, crash or CPU hog attributed to the SNMP ENGINE process, consistent with a crafted-packet stack overflow DoS or failed code execution attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco IOS XE SNMP Engine Process Fault or Traceback description: Detects Cisco IOS/IOS XE syslog messages in which the SNMP ENGINE or SNMP process shows a traceback, abnormal CPU hold, or crash. This is consistent with a crafted SNMP packet triggering the stack-based overflow in CVE-2025-20352 (DoS or failed code execution). Correlate with SNMP sources and device reloads. tags: - attack.initial-access - attack.t1190 logsource: product: cisco service: syslog detection: kw_process: - SNMP ENGINE - SNMP Traps - IP SNMP kw_fault: - Traceback - '%SYS-3-CPUHOG' - Abort at - Process = SNMP - SIGSEGV - crashed condition: kw_process and kw_fault falsepositives: - Known SNMP process bugs or heavy MIB walks on busy switches causing CPU hog messages - Firmware defects unrelated to exploitation level: medium id: f93a8e38-e36a-569e-acdb-7b5669a0ae3b status: experimental author: Vorant references: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-02
SNMP Traffic Allowed to Network Device from Non-Internal Source
Firewall logs showing UDP/TCP 161 traffic from a source outside private address ranges, exposing SNMP on Cisco devices to remote exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SNMP Traffic Allowed to Network Device from Non-Internal Source
description: Detects firewall-logged SNMP (port 161) connections that originate from
outside RFC1918 ranges and were allowed. CVE-2025-20352 is remotely exploitable
over SNMP, and the vendor guidance is to restrict device reachability and segment
control networks.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: firewall
detection:
selection:
dst_port: 161
action:
- allowed
- accept
- permit
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_internal
falsepositives:
- Managed service provider monitoring platforms polling devices from public address
space
- Cloud-hosted network monitoring tools with approved SNMP access
level: medium
id: 4f789b49-3b82-5f34-bdf7-5786a956dc3b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs