Hackers have exploited a remote code execution vulnerability (CVE-2025-20352) in Cisco networking devices to deploy rootkits targeting unprotected Linux systems. The attacks, tracked as 'Operation Zero Disco', involved the use of compromised Cisco devices to manipulate logs and network configurations, posing significant risks even to newer switches due to persistent targeting. Currently, there are no reliable tools to detect these compromises, making low-level investigations essential for suspected breaches.

Cisco has addressed a critical vulnerability in its IOS XE Software for Wireless LAN Controllers, identified as CVE-2025-20188, which allows unauthenticated attackers to hijack devices due to a hard-coded JSON Web Token. Although the flaw is potent, it is only exploitable if the 'Out-of-Band AP Image Download' feature is enabled, which is not the default setting. Administrators are urged to apply security updates immediately to mitigate the risk.

A critical vulnerability, identified as CVE-2025-20265, has been discovered in Cisco's Secure Firewall Management Center, which allows for remote code execution with a CVSS score of 10. Organizations using this software are urged to apply the necessary patches immediately to mitigate potential security threats.

Cisco has announced a critical vulnerability, tracked as CVE-2025-20337, in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allows unauthenticated remote attackers to gain root access through arbitrary code execution. The vulnerability has a maximum CVSS score of 10, and Cisco has released patches to address it along with related vulnerabilities disclosed in June. Customers are urged to upgrade to the latest software versions to mitigate the risk.

Cisco has issued security updates for a critical zero-day vulnerability (CVE-2025-20352) in its IOS and IOS XE Software, which is actively being exploited. The flaw allows remote attackers to execute code on vulnerable systems or cause denial-of-service conditions, prompting Cisco to recommend immediate upgrades to secure software versions.

Cisco has addressed a critical security vulnerability (CVE-2025-20309) in its Unified Communications Manager software, which allowed unauthenticated remote access due to static root account credentials that cannot be changed or deleted. The flaw was discovered during internal testing, and affected users are advised to update their systems or apply a provided patch, as exploitation indicators have been identified in system logs.

Technical details of a high-severity flaw in Cisco IOS XE WLC, identified as CVE-2025-20188, have been released, allowing potential exploitation by attackers. The vulnerability stems from a hard-coded JWT that enables unauthenticated file uploads and command execution on affected devices. Users are urged to upgrade to patched versions or disable the vulnerable feature immediately to mitigate risks.