# CVE-2025-20352 Not Detecting All Affected Versions? **URL:** \ **Category:** InsightVM\ **Created:** [October 1, 2025, 3:46pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257 "2025-10-01T15:46:59Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![mblough](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/779978/32.png) [@mblough](https://discuss.rapid7.com/u/mblough)\ **Post date:** [October 1, 2025, 3:46pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/1 "2025-10-01T15:46:59Z")
Anyone else noticing that some versions that are included in the Cisco “Affected Versions” for this release are not properly detected in this CVE within IVM? We have several versions that are on the list that do not show as vulnerable (with multiple recent scans). Thanks. ---
**Author:** ![martin\_votruba](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/martin_votruba/32/2733_2.png) [@martin\_votruba](https://discuss.rapid7.com/u/martin_votruba)\ **Post date:** [October 2, 2025, 7:38am UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/2 "2025-10-02T07:38:53Z")
Hi, our vulnerability check is not looking only at the affected version, but also on the model and the configuration of the device. As per the advisory the vulnerability affects devices that have SNMP turned on > **Note:** This vulnerability affects all versions of SNMP. All devices that have SNMP enabled and have not explicitly excluded the affected object ID (OID) should be considered vulnerable. For details on excluding the OID, see the [Workarounds](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte#wa) section of this advisory. [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte) Could it be that those devices do not have SNMP configured? Martin Votruba Principal Software Engineer @ Rapid7 ---
**Author:** ![mblough](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/779978/32.png) [@mblough](https://discuss.rapid7.com/u/mblough)\ **Post date:** [October 2, 2025, 12:38pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/3 "2025-10-02T12:38:41Z")
These devices definitely do have SNMP configured at the moment. ---
**Author:** ![jaguiar](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/jaguiar/32/2734_2.png) [@jaguiar](https://discuss.rapid7.com/u/jaguiar)\ **Post date:** [October 2, 2025, 1:02pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/4 "2025-10-02T13:02:00Z")
Just chiming in. We do not have Cisco devices in our environment. Do you have standalone Scan Engines or is your Security Console a hybrid? Have you made sure that the SNMP credentials have been added to the Security Console and are being included in your scans? Are your Cisco devices configured with v1/2 or v3? Hopefully the latter! ---
**Author:** ![martin\_votruba](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/martin_votruba/32/2733_2.png) [@martin\_votruba](https://discuss.rapid7.com/u/martin_votruba)\ **Post date:** [October 2, 2025, 1:09pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/5 "2025-10-02T13:09:30Z")
If they have SNPM configured, then we should be detecting this vulnerability. Could you please open a ticket with Support? Thanks ---
**Author:** ![mblough](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/779978/32.png) [@mblough](https://discuss.rapid7.com/u/mblough)\ **Post date:** [October 2, 2025, 1:13pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/6 "2025-10-02T13:13:29Z")
I put one in yesterday and provided the scan logs that were requested. I have not hear back since then. ---
**Author:** ![martin\_votruba](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/martin_votruba/32/2733_2.png) [@martin\_votruba](https://discuss.rapid7.com/u/martin_votruba)\ **Post date:** [October 2, 2025, 5:25pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/7 "2025-10-02T17:25:28Z")
I have had a look on your case and found the root cause, we are missfingerprinting your Cisco IOS XE instance as Cisco IOS. We are going to update our detection logic to fix this. ---
**Author:** ![mblough](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/779978/32.png) [@mblough](https://discuss.rapid7.com/u/mblough)\ **Post date:** [October 2, 2025, 7:06pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/8 "2025-10-02T19:06:34Z")
Thank you for the update, Martin. It is appreciated. Will the case be updated stating when the logic has changed, so that I can get them re-scanned as quick as possible? Thanks ---
**Author:** ![martin\_votruba](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/martin_votruba/32/2733_2.png) [@martin\_votruba](https://discuss.rapid7.com/u/martin_votruba)\ **Post date:** [October 3, 2025, 8:28pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/9 "2025-10-03T20:28:12Z")
The fix has been release in the latest content update 1.1.3717. @mblough you should be able to re-scan once you receive this update. Have a nice weekend, Martin ---
**Author:** ![mblough](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/779978/32.png) [@mblough](https://discuss.rapid7.com/u/mblough)\ **Post date:** [October 3, 2025, 9:00pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/10 "2025-10-03T21:00:59Z")
Thanks, I will check back on Monday. ---
**Author:** ![mblough](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/779978/32.png) [@mblough](https://discuss.rapid7.com/u/mblough)\ **Post date:** [October 8, 2025, 6:14pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/11 "2025-10-08T18:14:53Z")
This didn’t appear to fix anything in my environment. ---
**Author:** ![abarnett-r7](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/abarnett-r7/32/2736_2.png) [@abarnett-r7](https://discuss.rapid7.com/u/abarnett-r7)\ **Post date:** [October 21, 2025, 2:03pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/12 "2025-10-21T14:03:55Z")
@mblough were you able to resolve this by working with your network admin to permit the Rapid7 scan engine to target the Cisco device(s) via SNMP? ---
**Author:** ![mblough](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/779978/32.png) [@mblough](https://discuss.rapid7.com/u/mblough)\ **Post date:** [October 21, 2025, 2:17pm UTC](https://discuss.rapid7.com/t/cve-2025-20352-not-detecting-all-affected-versions/55257/13 "2025-10-21T14:17:34Z")
Yes, the SNMP fingerprint seems to be working much better. We have been much more successful in getting the correct OS’s on these devices.