Zero Disco Targets Old Cisco Switches with Linux Rootkits

Cybersecurity researchers say a recently patched Cisco vulnerability has been exploited in a campaign that installs Linux rootkits on older, unpatched network switches, granting attackers persistent, stealthy control. The activity, tracked by Trend Micro as Operation Zero Disco, targeted Cisco 9400, 9300 and legacy 3750G series devices and relied on a high‑severity Simple Network Management Protocol defect identified as CVE‑2025‑20352, which Cisco patched in late September.

According to Trend Micro, the flaw is a stack overflow in the SNMP subsystem of Cisco IOS and IOS XE that can cause denial of service with low privileges and allow remote code execution with higher privileges. Cisco’s Product Security Incident Response Team said it was "aware of successful exploitation." Researchers found operators combined exploits for CVE‑2025‑20352 with a modified Telnet vulnerability derived from CVE‑2017‑3881 to obtain arbitrary memory read and write, deepen footholds, and deploy rootkits on affected devices.

The implanted malware hooks into the IOS daemon memory and sets a volatile universal password that contains the word disco, a string Trend Micro says the attackers used to gain...