H-ISAC TLP White Threat Bulletin: Operation ZeroDisco Campaign Exploits Cisco SNMP Flaw (CVE-2025-20352)

On October 15, 2025, Trend Micro disclosed an active attack campaign, dubbed Operation ZeroDisco, exploiting two vulnerabilities in older, unpatched Cisco devices. The primary flaw being exploited in the campaign, tracked as CVE-2025-20352, is a critical simple network management protocol (SNMP) vulnerability. Conversely, the other flaw is a modified Telnet flaw, identified as CVE-2017-3881.

The campaign enables authenticated remote code execution (RCE) to deploy a Linux rootkit that grants attackers persistent, stealthy access to network infrastructure. A vendor patch is available for CVE-2025-20352, and patching and mitigation are recommended to prevent core network compromise.

Health-ISAC is sharing this to increase situational awareness and encourage organizations to assess their level of risk to this activity.

View the detailed report below.