# Rockwell Automation IDC SNMP stack overflow allows root code execution

Published: 2025-10-09 · Severity: elevated · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/37c89254-c109-5df6-959a-590c2c8131b4/rockwell-automation-idc-snmp-stack-overflow-allows-root-code-execution

> Stack buffer overflow in Cisco IOS XE SNMP affects Rockwell Automation Lifecycle Services; authenticated remote attacker with high privileges can execute code.

Rockwell Automation Lifecycle Services products that incorporate Cisco IOS XE Software contain a stack-based buffer overflow vulnerability (CVE-2025-20352) in the SNMP subsystem. The vulnerability affects Industrial Data Center (IDC) with Cisco Switching (Generations 1-5), IDC-Managed Support contracts with Cisco Switching (Generations 1-5), Network-Managed Support contracts with Cisco network switches (all versions), and Firewall-Managed Support contracts with Cisco firewalls (all versions).

An authenticated remote attacker with low privileges and a valid SNMPv2c or earlier read-only community string or SNMPv3 credentials can cause a denial-of-service condition by sending a crafted SNMP packet. An authenticated attacker with high privileges holding SNMPv1/v2c read-only community strings or SNMPv3 credentials plus administrative or privilege level 15 credentials can execute arbitrary code as root and achieve full system control. The attack is remotely exploitable over IPv4 or IPv6 with low attack complexity.

CISA reports no known public exploitation in the wild as of October 2025. Rockwell Automation customers with active managed service contracts should contact the vendor for remediation guidance. All others should apply Cisco's workarounds and network segmentation controls to restrict device accessibility and isolate control system networks behind firewalls.

## Mentioned in this report

- Vulnerabilities: CVE-2025-20352 (KEV)

## Detection guidance (public sample)

### Cisco IOS XE SNMP Authentication Failure Burst Indicative of Community String Guessing

ATT&CK: T1078.001

Cisco device syslog SNMP-3-AUTHFAIL events, which show attempts with invalid SNMP community strings or credentials, a prerequisite for CVE-2025-20352 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco IOS XE SNMP Authentication Failure Burst Indicative of Community String
  Guessing
description: Detects Cisco IOS/IOS XE syslog SNMP authentication failure messages
  (SNMP-3-AUTHFAIL). CVE-2025-20352 exploitation requires a valid read-only community
  string or SNMPv3 credentials, so guessing or default strings (public/private) precede
  it. Alert on repeated hits from the same source within a short window; the threshold
  is applied in the SIEM, not in this rule.
tags:
- attack.initial-access
- attack.t1078.001
- attack.t1190
logsource:
  product: cisco
  service: syslog
detection:
  keywords:
  - '%SNMP-3-AUTHFAIL'
  - Authentication failure for SNMP request
  condition: keywords
falsepositives:
- Network monitoring systems polling with a stale or misconfigured community string
- Vulnerability scanners run by the internal security team
level: medium
id: e9cc941d-acfc-5c40-b302-1e591a8dfbcf
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-02
```

### Cisco IOS XE SNMP Engine Process Fault or Traceback

ATT&CK: T1190

Cisco syslog showing a traceback, crash or CPU hog attributed to the SNMP ENGINE process, consistent with a crafted-packet stack overflow DoS or failed code execution attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco IOS XE SNMP Engine Process Fault or Traceback
description: Detects Cisco IOS/IOS XE syslog messages in which the SNMP ENGINE or
  SNMP process shows a traceback, abnormal CPU hold, or crash. This is consistent
  with a crafted SNMP packet triggering the stack-based overflow in CVE-2025-20352
  (DoS or failed code execution). Correlate with SNMP sources and device reloads.
tags:
- attack.initial-access
- attack.t1190
logsource:
  product: cisco
  service: syslog
detection:
  kw_process:
  - SNMP ENGINE
  - SNMP Traps
  - IP SNMP
  kw_fault:
  - Traceback
  - '%SYS-3-CPUHOG'
  - Abort at
  - Process = SNMP
  - SIGSEGV
  - crashed
  condition: kw_process and kw_fault
falsepositives:
- Known SNMP process bugs or heavy MIB walks on busy switches causing CPU hog messages
- Firmware defects unrelated to exploitation
level: medium
id: f93a8e38-e36a-569e-acdb-7b5669a0ae3b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-02
```

### SNMP Traffic Allowed to Network Device from Non-Internal Source

ATT&CK: T1190

Firewall logs showing UDP/TCP 161 traffic from a source outside private address ranges, exposing SNMP on Cisco devices to remote exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SNMP Traffic Allowed to Network Device from Non-Internal Source
description: Detects firewall-logged SNMP (port 161) connections that originate from
  outside RFC1918 ranges and were allowed. CVE-2025-20352 is remotely exploitable
  over SNMP, and the vendor guidance is to restrict device reachability and segment
  control networks.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: firewall
detection:
  selection:
    dst_port: 161
    action:
    - allowed
    - accept
    - permit
  filter_internal:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_internal
falsepositives:
- Managed service provider monitoring platforms polling devices from public address
  space
- Cloud-hosted network monitoring tools with approved SNMP access
level: medium
id: 4f789b49-3b82-5f34-bdf7-5786a956dc3b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-282-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/37c89254-c109-5df6-959a-590c2c8131b4/rockwell-automation-idc-snmp-stack-overflow-allows-root-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup