Cisco Zero-Day Exploited to Plant Rootkits on Network Switches
▼ Summary
– Threat actors exploited Cisco’s CVE-2025-20352 vulnerability to deploy Linux rootkits on vulnerable network devices, particularly targeting older systems without endpoint detection.
– The rootkit sets a universal password containing “disco,” installs memory hooks to hide fileless components after reboot, and includes a UDP controller for powerful management functions.
– CVE-2025-20352 is a stack overflow vulnerability in Cisco’s SNMP subsystem that allows remote code execution if attackers have valid administrator credentials and send crafted SNMP packets.
– Attackers targeted Cisco 9400, 9300, and 3750G series devices using multiple exploits, including a modified Telnet vulnerability, and deployed tools for ARP spoofing and log manipulation.
– Cisco advises customers to check and update affected devices, while Trend Micro recommends contacting Cisco TAC for investigation if compromise is suspected, as no universal automated detection tool exists.
A recently patched vulnerability in Cisco’s network operating systems has been actively exploited by attackers to install persistent Linux rootkits on vulnerable switches. This critical security flaw, identified as CVE-2025-20352, enables threat actors with valid administrative credentials to execute remote code and deploy sophisticated malware. Security researchers at Trend Micro discovered that the campaign specifically targeted organizations using older Linux systems lacking modern endpoint detection capabilities.
The attackers successfully implanted a rootkit that establishes a universal password containing the word “disco” and installs memory hooks within the IOSd process space. These hooks ensure that fileless components vanish following a system reboot, making detection significantly more challenging. The operation demonstrates advanced persistence techniques that can evade conventional security monitoring.
CVE-2025-20352 represents a stack overflow vulnerability within the Simple Network Management Protocol subsystem of Cisco IOS and IOS XE software. Cisco addressed this security issue in late September 2025 after observing its exploitation in zero-day attacks. The company confirmed that attackers could trigger this vulnerability by sending specially crafted SNMP packets across IPv4 or IPv6 networks to susceptible devices. Successful exploitation requires the attacker to already possess high-privilege local administrator credentials, which they then leverage to achieve remote code execution capabilities.
Trend Micro’s investigation revealed that the threat actors focused their attacks on Cisco 9400, 9300, and legacy 3750G series switches. The attackers employed multiple exploits designed to work across both 32-bit and 64-bit platforms. In addition to the primary vulnerability, they attempted to leverage a modified version of an older Telnet vulnerability (CVE-2017-3881) to gain arbitrary memory read and write privileges.
The research team identified several distinct components within the attack framework. One module specializes in installing the Linux rootkit, while another halts trace logging on the compromised device. Investigators also discovered a UDP controller component that manages the rootkit’s operations and an ARP spoofing tool deployed on affected Cisco switches.
The UDP controller provides comprehensive management capabilities, including the ability to toggle log history on or off, completely delete log records, bypass AAA authentication and VTY access-control lists, enable or disable the universal password feature, conceal specific sections of the running configuration, and reset the timestamp of the last configuration write operation. This final function makes it appear as though the configuration has never been modified. The ARP spoofing tool redirects network traffic intended for the switch through the attacker’s system first.
Cisco recommends that customers utilize their Software Checker tool or consult the security advisory for CVE-2025-20352 to determine if their devices run vulnerable software versions. Immediate patching is strongly advised for any affected systems. While Trend Micro has published indicators of compromise associated with these attacks, they note that no universal automated tool currently exists to definitively identify compromises from what they’ve termed the “ZeroDisco” operation.
Organizations suspecting compromise should contact Cisco’s Technical Assistance Center immediately for specialized support with low-level firmware, ROM, and boot region investigations. Although older switch models appear to be the primary targets, newer devices remain potentially vulnerable despite implementing security measures like Address Space Layout Randomization. While ASLR reduces the success rate of intrusion attempts, determined attackers can still achieve compromise through repeated exploitation efforts.
(Source: HelpNet Security)
