China’s Salt Typhoon hackers targeting Cisco devices used by telcos, universities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) CVE-2023-20198 is a critical (CVSS 10.0) unauthenticated privilege escalation flaw in the web UI of Cisco IOS XE software, triggered by sending crafted network requests to the exposed web management interface. An attacker with no credentials can use the flaw to gain initial access and issue a privilege 15 command, creating a local user with normal login access; the attacker then chained CVE-2023-20273 (CVSS 7.2) to elevate that account to root and write an implant to the file system. Successful exploitation yields full administrative control of the device, including persistence via the planted implant, on Cisco IOS XE devices with the web UI enabled and reachable from the internet or untrusted networks, including Rockwell Automation Allen-Bradley Stratix 5200 and 5800 switches running IOS XE. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-10-16 with a BOD 23-02 directive, EPSS stands at 99.6% (100th percentile), and ongoing campaigns (including the 'BADCANDY' activity flagged by Australia's ASD and Cisco-related telecom intrusions attributed to Salt Typhoon) have been reported. Do: Upgrade affected devices to the fixed releases listed in Cisco's advisory (use Cisco's Software Checker) and, as immediate mitigation, disable the web UI or restrict it to trusted networks/addresses only. Check for compromise by looking for unexpected local user accounts and the implant artifacts Cisco identified (unexpected cisco_tac_alarm.log and cisco_tac.log files in /tmp or /usr/binos/conf), and immediately report positive findings to CISA per BOD 23-02. Keep in mind that patching alone does not remove a root implant, so devices with evidence of compromise should be reimaged or otherwise cleaned per vendor instructions. | 10.0 | 100% | KEV |
| large≈40,000–50,000 internet-exposed IOS XE devices at the time of disclosure (public scan data), within an IOS XE install base in the millions | |
| CVE-2023-20273 | Authenticated Command Injection (Root) in Cisco IOS XE Web UI CVE-2023-20273 is an OS command injection flaw (CWE-78) in the web UI feature of Cisco IOS XE Software, caused by insufficient input validation. An authenticated, remote attacker triggers it by sending crafted input to the web UI, and a successful exploit injects commands that run on the underlying operating system with root privileges, yielding full device compromise (in the October 2023 mass-exploitation campaign it was typically chained with the unauthenticated CVE-2023-20198 to obtain initial access and install a persistent implant). Any Cisco IOS XE device with the web UI enabled and reachable from the internet or an untrusted network is affected; this data does not specify the affected release ranges, which are enumerated in Cisco's advisory. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2023-10-23 with BOD 23-02 response actions, EPSS is ~90% (100th percentile), and IOS XE edge devices remain recurring targets of Chinese-nexus espionage campaigns (e.g., Salt Typhoon activity against telecoms). Do: Upgrade affected devices to a fixed IOS XE release per Cisco's advisory; as an interim mitigation, disable the HTTP/HTTPS server (ip http server / ip https server) or restrict Web UI access to trusted hosts only. Per BOD 23-02, hunt for compromise on any exposed device — check for unexpected level-15 local accounts and the implant.lua backdoor in flash memory — and immediately report positive findings to CISA. | 7.2 | 90% | KEV |
| mass≈100,000+ internet-exposed IOS XE devices (public scans observed ~40,000+ compromised within days of disclosure) |
Full article724 words · extracted from therecord.media · click to collapse
China’s Salt Typhoon campaign to breach telecommunications companies has continued through the new year despite efforts by governments to stop the hackers, researchers said Thursday. Recorded Future’s Insikt Group identified a campaign in December and January that involved attempts to compromise more than 1,000 Cisco network devices globally, many of which are associated with telecommunications providers. The Record is an editorially independent unit of Recorded Future. Among the targeted organizations was a South African telecom, as well as a U.S.-based affiliate of a UK telecommunications company. “The group likely compiled a list of target devices based on their association with telecommunications providers' networks,” the researchers said. Insikt Group observed seven total compromised Cisco network devices communicating with Salt Typhoon infrastructure — including those connected to telecommunications companies in the U.S. and South Africa, as well as others in Italy and Thailand. Researchers also saw the group carry out reconnaissance activity in December on IP addresses owned by the Myanmar-based provider Mytel. More than half of the Cisco devices targeted by Salt Typhoon were in the U.S., South America, and India. The remaining devices spanned more than 100 other countries. They also observed the hackers targeting devices connected to universities in Argentina, Bangladesh, Indonesia, Malaysia, Mexico, the Netherlands, Thailand, the U.S. and Vietnam. The researchers theorized that the hackers attacked universities to access research in areas related to telecommunications, engineering and technology. U.S. officials have for months raised alarms about Salt Typhoon, which they say has breached at least nine U.S. telecommunications giants including Verizon, T-Mobile, AT&T and Lumen. As in other Chinese government hacking campaigns, Salt Typhoon has made a point of targeting unpatched network devices like those from Cisco to gain initial access to critical systems. The hackers allegedly used their deep access to telecom networks to obtain call information from several high-profile political figures, including Donald Trump, the Republican presidential nominee at the time, and his running mate JD Vance, as well as senior Democratic Party leaders and members of then-Vice President Kamala Harris’ staff. The hackers targeted unpatched Cisco devices vulnerable to the bugs CVE-2023-20198 and CVE-2023-20273. The first bug was the method of entry while the second allowed for escalated privileges in a victim’s system. The hackers have been reconfiguring the exploited devices and creating a link to them that allows for persistent access. Insikt Group saw the hackers scanning for exploitable devices on six distinct occasions throughout December and January, including on December 4, 10, 17 and 24. In January, the hackers scanned for unpatched devices on the 13th and 23rd. The geographical spread of Cisco devices targeted by Salt Typhoon. Credit: Recorded Future The researchers urged any administrators using these specific Cisco network devices to check for potential exploitation on those dates. Using its own scanning tools, Insikt Group found more than 12,000 Cisco network devices exposed to the internet — leading them to believe the Salt Typhoon activity was targeted given that only a portion of the devices were attacked. The FBI and Department of Homeland Security did not respond to requests for comment about the activity. The Justice Department said it had nothing further to add. In January, the Treasury Department announced sanctions against a Chinese contractor allegedly involved in the Salt Typhoon campaign. The Treasury Department said Salt Typhoon has compromised “numerous” U.S. companies in the communication sector since 2019 but the most recent campaign against multiple major U.S. telecommunication and internet service provider companies marks “a dramatic escalation in the Chinese cyber operations against U.S. critical infrastructure targets.” In its report on Thursday, Insikt Group said Chinese threat activity has shifted heavily toward exploiting Cisco devices for initial access over the past five years. “[Salt Typhoon] exploitation of telecommunications infrastructure goes beyond technical vulnerabilities and represents a strategic intelligence threat,” they said. “Persistent access to critical communications networks enables state-backed threat actors to monitor confidential conversations, manipulate data flows, and disrupt services during geopolitical conflicts.” READ MORE: Munich Cyber Security Conference 2025 Live Updates Points of entry
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/china-salt-typhoon-cisco-devices