Hackers exploit Cisco SNMP flaw to deploy rootkit on switches
Read original article ↗AI Summary
Threat actors have exploited a recently patched SNMP vulnerability (CVE-2025-20352) in Cisco IOS and IOS XE devices to deploy a rootkit on vulnerable switches, enabling them to bypass access controls, manipulate logs, and move laterally across VLANs. The attacks, tracked as 'Operation Zero Disco' by Trend Micro, target older Linux systems lacking endpoint detection and response solutions. The rootkit includes fileless components that persist across reboots via IOSd hooks, and attackers also attempted to exploit the older CVE-2017-3881 vulnerability. Cisco confirmed the exploitation of CVE-2025-20352 as a zero day, with no reliable detection tool currently available.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.