Cisco IOS/IOS XE SNMP Zero-Day Exploitation and Operation Zero Disco

Attackers are exploiting **CVE-2025-20352** in the **SNMP subsystem** of **Cisco IOS Software and IOS XE Software**, turning a stack-based buffer overflow into real-world compromise of network devices. Cisco said the flaw was exploited before fixes were available, and the issue can produce denial of service on unpatched systems or root-level code execution on vulnerable **IOS XE** devices when attacker privileges are sufficient. Later reporting described the exploitation as **Operation Zero Disco**, a campaign that used the bug as a zero-day to deploy **Linux rootkits** on older, unprotected systems and to target **Cisco 9400**, **9300**, and legacy **3750G** devices. The activity also included attempts to use a modified **CVE-2017-3881** Telnet weakness for memory access, while operators embedded hooks in **IOSd** memory, used a UDP controller, and created a universal password built around the word **"disco"** to preserve access and conceal changes. Cisco released patches for affected **IOS** and **IOS XE** versions, including fixes referenced for **IOS XE 17.15.4a**, and said there is no full workaround beyond moving to a fixed release. For systems that could not be upgraded immediately, Cisco advised restricting SNMP to trusted users, monitoring affected systems with **show snmp host**, and disabling affected object identifiers where supported, though those steps only reduce exposure. Available material does not identify the operator behind **Operation Zero Disco**, does not quantify how many devices were compromised, and does not establish how broadly the rootkit techniques succeeded across exposed Cisco environments. What is clear is that **CVE-2025-20352** moved from zero-day disclosure into a persistence-focused intrusion story, so defenders need both patch deployment and compromise assessment on potentially exposed devices.