Chinese-linked APT group Salt Typhoon has actively exploited a critical Cisco IOS XE vulnerability (CVE‑2023‑20198) to infiltrate telecom networks, security agencies confirm. The flaw, rated 10.0 for severity, allowed attackers to steal configuration data and establish GRE tunnels for prolonged surveillance.
Cisco Breach Affects Global Telecom Providers By Chinese Salt Typhoon
Security units from Canada and the US have identified breaches affecting a Canadian telecom provider in mid-February 2025. Attackers retrieved configuration files from Cisco routers and inserted GRE tunnels to collect traffic stealthily. While initial findings suggest the intrusion focused on reconnaissance. Officials caution that other sectors—like critical infrastructure or government networks—may also be at risk.
Telecom firms worldwide face growing threats from state-backed hackers. Salt Typhoon, a moniker linked to previous Cisco and Fortinet exploits has adapted its approach by targeting edge devices to gain covert access. Analysts warn that compromised routers not only expose network secrets but also serve as launchpads for deeper attacks.
Earlier research found related exploits involving Cisco and Fortinet devices, reinforcing the pattern of targeting network gear to establish persistence. The latest Cisco breach signals a widening cyber-espionage campaign from Chinese-linked actors. Capable of layering advanced tactics onto standard infrastructure components.
With its high severity and calculated targeting, this Cisco vulnerability exploitation underscores the urgent need for immediate patching and network segmentation controls. Telecom providers and enterprise IT teams are strongly advised to apply Cisco’s latest updates and restrict access to router management interfaces to mitigate future threats.
Grab more recent updates on our WhatsApp Channel https://whatsapp.com/channel/0029VbAlelm0bIdkugHu5U1L
