Older Cisco devices unpatched against a recent zero-day vulnerability have been infected with a rootkit in a new campaign, Trend Micro reports. The exploited defect, tracked as CVE-2025-20352 (CVSS score of 7.7), was patched in late September, when Cisco warned of its in-the-wild exploitation. Described as a stack overflow issue in the Simple Network Management Protocol (SNMP) of IOS and IOS XE devices, the bug allows low-privileged attackers to cause a denial-of-service (DoS) condition and can be exploited by high-privileged attackers for remote code execution (RCE). Now, Trend Micro says it has observed a threat actor exploiting the vulnerability to deploy a rootkit on older, vulnerable devices, including Cisco 9400, 9300, and legacy 3750G series devices. “The operation targeted victims…