{"uuid": "670a15ed-ed3e-4a1b-9fd4-eedf559cb0aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://t.me/cissp/7834", "content": "#Analytics\n#ThreatResearch\nAn analytical review of the main cybersecurity events for the 2025\n\n\u0632\u0646\u062f\u06af\u06cc \u062f\u06cc\u0648\u0627\u0646\u0647\u200c\u0648\u0627\u0631!\n\u0647\u0627\u0644\u0648\u0648\u06cc\u0646 \u06a9\u0647 \u0646\u0632\u062f\u06cc\u06a9 \u0648 \u200c\u0631\u062f \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062f\u0646\u06cc\u0627 \u0627\u0646\u06af\u0627\u0631 \u0686\u0647\u0631\u0647\u200c\u06cc \u0648\u0627\u0642\u0639\u06cc\u200c\u062a\u0631\u0634 \u0631\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f\u2026 \u0634\u062e\u0635\u06cc\u062a\u200c\u0647\u0627 \u0647\u0631 \u0631\u0648\u0632 \u0639\u062c\u06cc\u0628\u200c\u062a\u0631\u061b \u0622\u062f\u0645\u200c\u0647\u0627 \u0647\u0631 \u0644\u062d\u0638\u0647 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647\u200c\u062a\u0631.\n\u062f\u06cc\u0648\u0627\u0646\u06af\u06cc\u061f \u06cc\u0627 \u0648\u0627\u0642\u0639\u06cc\u062a\u06cc \u06a9\u0647 \u062c\u0631\u0623\u062a \u062f\u06cc\u062f\u0646\u0634 \u0631\u0627 \u0646\u062f\u0627\u0631\u06cc\u0645\u061f \n\n\u0639\u0631\u0635\u0647\u200c \u0639\u0631\u0636\u0647\ud83d\ude42 \u0646\u0627\u062f\u0627\u0646\u06cc \u0648 \u062a\u0648\u0647\u0645 \u062f\u0627\u0646\u0627\u06cc\u06cc \u0627\u0633\u062a\n\u0647\u0631 \u0631\u0648\u0632 \u0627\u06cc\u0646 \u062f\u0627\u0633\u062a\u0627\u0646\u2026\u062f\u0627\u0631\u06a9 \u0648 \u0639\u0645\u06cc\u0642 \u200c\u062a\u0631\n\u0627\u0645\u0627 \u0647\u0645\u0627\u0647\u0646\u06af \u0628\u0627 \u062a\u0646\u067e\u0648\u0634 \u0645\u062f \u0631\u0648\u0632! \u062a\u0645 \u062a\u0645 \u0639\u0648\u0627\u0645!!!\n\u0639\u062c\u06cc\u0628\u200c\u0628\u0648\u062f\u0646 \u062a\u0631\u0633\u0646\u0627\u06a9 \u0646\u06cc\u0633\u062a\u061b\n\u062a\u0631\u0633\u0646\u0627\u06a9 \u0622\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0647\u0631\u06af\u0632 \u2026 !\n\n\u0648 \u0627\u06af\u0631 \u0634\u0645\u0633 \u062a\u0628\u0631\u06cc\u0632\u06cc \u0628\u0627\u062f\u0647\u200c\u0627\u06cc \u0628\u0631 \u062c\u0627\u0645\u0645 \u0646\u0647\u062f\u060c\n\u0645\u0633\u062a \u06a9\u0647 \u0634\u0648\u0645\u2026\n\u0628\u06cc\u200c\u067e\u0631\u0648\u0627\u060c \u0633\u062a\u0648\u0646 \u06a9\u06cc\u0648\u0627\u0646 \u0631\u0627 \u2026! \n\n\u0628\u06af\u0630\u0631\u06cc\u0645\u061b \n\n1.Operation Zero Disco: \nAttackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits, Cisco 9400, 9300, and legacy 3750G series devices are affected. A detailed analysis of the vulnerability (CVE-2017-3881) and PoC were published on our channel in 2018. Second exploited vulnerability (CVE-2025-20352) - Stack-based BoF. This vulnerability affects all versions of SNMP. Restrict SNMP access via ACLs and CoPP to management hosts only, switch to using only SNMPv3 with authPriv mode, stop using standard communities in v1/v2c, update IOS and IOS XE to builds with the fix, and configure monitoring of sysDescr sysUpTime and activity on port UDP/161. Disable telnet..\nCVE-2025-20352 SNMP Exposure Check (onesixtyone + parser).\n\n2.Framework BIOS Backdoor:\nThe mm command impleneted in Framework BIOS shells can be used to compromise a device pre-boot (BombShell). The attack surface \u201cbelow\u201d the operating system, encompassing firmware, bootloaders, and hardware components, presents a ripe target for threat actors. Implement proper configuration management and maintain up-to-date revocation lists. Follow the principle \"signed doesn't mean safe\"... .\n\n3 Fewer Weights, More Problems: \nA Practical Attack on LLM Pruning, Modern LLM pruning methods can be maliciously exploited... The most read post of the week on our channel.\n\n4. F5 BIG-IP Compromise:\nThere was no publication on this topic on our channel, since we have repeatedly drawn the attention of readers to the existing VERY serious problems with this equipment, publishing detailed PoC exploits on the channel in 2024 (CVE-2024-45844) and 2025 (CVE-2025-20029).\n\n\u2014 CISO as a Service \u2014\n| Strategic Cyber Defense & GRC\nResilient Through Knowledge\n2025.11.04\n\nhttps://www.linkedin.com/posts/alirezaghahrood_analytics-threatresearch-activity-7391560156158971904-XBpT", "creation_timestamp": "2026-09-02T01:03:47.644780Z"}