CVE-2025-20352 Not Detecting All Affected Versions?

InsightVM
1

Anyone else noticing that some versions that are included in the Cisco “Affected Versions” for this release are not properly detected in this CVE within IVM? We have several versions that are on the list that do not show as vulnerable (with multiple recent scans).

Thanks.

2

Hi, our vulnerability check is not looking only at the affected version, but also on the model and the configuration of the device. As per the advisory the vulnerability affects devices that have SNMP turned on

Note: This vulnerability affects all versions of SNMP. All devices that have SNMP enabled and have not explicitly excluded the affected object ID (OID) should be considered vulnerable. For details on excluding the OID, see the Workarounds section of this advisory.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte

Could it be that those devices do not have SNMP configured?

Martin Votruba
Principal Software Engineer @ Rapid7

3

These devices definitely do have SNMP configured at the moment.

4

Just chiming in.

We do not have Cisco devices in our environment. Do you have standalone Scan Engines or is your Security Console a hybrid? Have you made sure that the SNMP credentials have been added to the Security Console and are being included in your scans? Are your Cisco devices configured with v1/2 or v3? Hopefully the latter!

5

If they have SNPM configured, then we should be detecting this vulnerability. Could you please open a ticket with Support? Thanks

6

I put one in yesterday and provided the scan logs that were requested. I have not hear back since then.

7

I have had a look on your case and found the root cause, we are missfingerprinting your Cisco IOS XE instance as Cisco IOS. We are going to update our detection logic to fix this.

2 Likes
8

Thank you for the update, Martin. It is appreciated. Will the case be updated stating when the logic has changed, so that I can get them re-scanned as quick as possible?

Thanks

9

The fix has been release in the latest content update 1.1.3717. @mblough you should be able to re-scan once you receive this update.

Have a nice weekend,
Martin

1 Like
10

Thanks, I will check back on Monday.

1 Like
11

This didn’t appear to fix anything in my environment.

12

@mblough were you able to resolve this by working with your network admin to permit the Rapid7 scan engine to target the Cisco device(s) via SNMP?

13

Yes, the SNMP fingerprint seems to be working much better. We have been much more successful in getting the correct OS’s on these devices.

1 Like