CVE-2025-20172
First published: Wed Feb 05 2025(Updated: )
A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. For Cisco IOS and IOS XE Software, a successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. For Cisco IOS XR Software, a successful exploit could allow the attacker to cause the SNMP process to restart, resulting in an interrupted SNMP response from an affected device. Devices that are running Cisco IOS XR Software will not reload. This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco IOS and IOS XE Software | ||
| Cisco IOS XRv 9000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-20172?
CVE-2025-20172 has been classified with a critical severity rating due to its potential to cause a denial-of-service (DoS) condition on affected devices.
How do I fix CVE-2025-20172?
To mitigate CVE-2025-20172, update your Cisco IOS, IOS XE, or IOS XR Software to the latest version provided by Cisco that addresses this vulnerability.
Who is affected by CVE-2025-20172?
CVE-2025-20172 affects devices running Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software.
What is the impact of CVE-2025-20172?
The impact of CVE-2025-20172 is the potential for an authenticated remote attacker to exploit the vulnerability and cause a DoS condition.
Is CVE-2025-20172 remote exploitable?
Yes, CVE-2025-20172 can be remotely exploited by an authenticated attacker.
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/source
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios
- canonical/cisco ios and ios xe software
- canonical/cisco ios xrv 9000