Chinese state-sponsored threat group Salt Typhoon has been exploiting critical vulnerabilities in Cisco IOS XE routers to infiltrate major U.S. telecommunications networks, marking one of the most significant supply chain and infrastructure attacks in recent memory. The campaign, which leveraged a CVSS 10.0 zero-day vulnerability, has sent shockwaves through the cybersecurity community and raised urgent questions about the resilience of critical communications infrastructure.
The Exploit Mechanics
The attack hinges on two critical CVEs: CVE-2023-20198 and CVE-2023-20273. The first vulnerability, CVE-2023-20198, carries a maximum CVSS score of 10.0 and allows remote, unauthenticated attackers to create administrative accounts with privilege level 15 — the highest access tier available on Cisco IOS XE devices. This means an attacker sitting anywhere on the internet could essentially craft themselves a god-mode account on affected routers without needing any credentials whatsoever.
The second vulnerability, CVE-2023-20273, serves as the escalation vector. Once the attacker has established an administrative foothold through CVE-2023-20198, they chain it with CVE-2023-20273 to escalate privileges to root level. This two-stage approach is particularly elegant — and devastating — because it transforms what might otherwise be a configuration-level compromise into full system control, granting access to the underlying operating system and all data flowing through the device.
Recorded Future’s Insikt Group, which has been tracking Salt Typhoon’s operations extensively, reports that the threat actors deploy custom implants after achieving root access. These implants are designed for persistence, data exfiltration, and lateral movement within compromised networks, effectively turning the routers into covert surveillance nodes that can intercept, modify, or redirect traffic at will.
Affected Systems
The scope of affected systems is staggering. Cisco IOS XE powers a substantial portion of enterprise and carrier-grade networking equipment worldwide, and the vulnerabilities impact a wide range of products including Catalyst switches, ISR routers, and ASR platforms. Major U.S. telecommunications providers — the backbone of American communications infrastructure — were specifically targeted, suggesting a deliberate strategic objective rather than opportunistic exploitation.
The timing is particularly concerning. These vulnerabilities were disclosed and patched in late 2023, but Salt Typhoon’s campaign demonstrates that the window between patch availability and actual deployment remains a critical weakness. Many organizations, particularly large telecoms with complex infrastructure, take weeks or months to roll out firmware updates across their entire fleet of networking equipment. This patching lag creates an extended exploitation window that sophisticated threat actors like Salt Typhoon are adept at exploiting.
The Mitigation Strategy
Cisco has released patches for both CVEs, and the company strongly recommends immediate deployment. However, mitigation goes beyond simply applying patches. Organizations should conduct thorough forensic reviews of their Cisco IOS XE devices to identify any signs of compromise, including unexpected administrative accounts, unusual configuration changes, or anomalous network traffic patterns.
Network segmentation is another critical mitigation layer. By isolating management interfaces from production traffic and implementing strict access controls, organizations can limit the blast radius of any single compromised device. Multi-factor authentication for administrative access, regular credential rotation, and comprehensive logging with real-time alerting are essential complementary measures.
For telecommunications providers specifically, the incident underscores the need for continuous monitoring of infrastructure devices. Traditional security tools focused on endpoints and servers often provide limited visibility into the networking layer, creating blind spots that sophisticated adversaries can exploit. Deploying network detection and response solutions that can identify unusual behavior at the infrastructure level is increasingly essential.
Lessons Learned
The Salt Typhoon campaign offers several critical lessons for the cybersecurity community. First, CVSS 10.0 vulnerabilities in widely deployed infrastructure equipment represent existential risks that demand immediate attention. Organizations cannot afford to treat these as routine patching tasks — they require emergency response protocols with dedicated resources and executive oversight.
Second, the incident highlights the interconnected nature of modern communications infrastructure. When a single vendor’s product line powers equipment across multiple major carriers, a vulnerability in that product becomes a systemic risk. This concentration of technology creates attractive targets for nation-state actors seeking broad access to communications data.
Third, the campaign demonstrates the increasing sophistication of Chinese APT groups. Salt Typhoon’s operational security, tooling sophistication, and strategic targeting suggest a well-resourced, professionally managed intelligence operation. The threat landscape has evolved well beyond opportunistic exploitation into sustained, purpose-driven campaigns against critical infrastructure.
User Action Required
While the Salt Typhoon campaign primarily targets infrastructure providers, individual users and organizations should take several steps in response. First, verify that any Cisco networking equipment under your control has been patched against CVE-2023-20198 and CVE-2023-20273. Check Cisco’s security advisories for the latest guidance and specific version requirements.
For cryptocurrency users and businesses, this incident is a stark reminder that network-level compromises can undermine even the strongest endpoint security. Consider using VPNs with verified no-log policies for all crypto transactions, implement hardware wallets for significant holdings, and maintain awareness that your traffic may traverse compromised infrastructure at any point between your device and the blockchain network.
Monitor official communications from your internet and telecommunications providers regarding any security incidents. If your provider confirms exposure to the Salt Typhoon campaign, assume that traffic metadata — including connection times, destinations, and volumes — may have been compromised. Adjust your operational security posture accordingly.
Disclaimer: This article is for informational purposes only and does not constitute financial or cybersecurity advice. Always consult with qualified professionals for security decisions.
cvss 10.0 zero-day and nobody at cisco caught it during testing. wild how the biggest exploits are always the simplest ones
privilege 15 out of the box with no auth is not simple, its just bad security hygiene on ciscos part
cisco sells these routers to telecoms with 5+ year lifecycles. firmware updates require scheduled downtime which means they get deferred forever. the security model assumes patching that never happens at scale
its always a missing auth check. the MOVEit hack was the same pattern last year. devs keep skipping basic input validation on management interfaces
simple in hindsight. cvss 10.0 zero-days are usually a missing auth check or a hardcoded credential. complexity is overrated as a risk factor
The concerning part is how long this campaign may have been active before discovery. State-sponsored actors don’t typically get caught quickly.
threat intel suggests salt typhoon was in those networks for months before the cisco vulns were even disclosed. they had other entry points
months of persistence and they still needed a CVSS 10.0 vuln as cover. makes you wonder how many other backdoors are sitting in enterprise router firmware rn
CVE-2023-20198 was patched in october 2023. salt typhoon exploited it months later meaning thousands of orgs never applied the update. the patching gap is the real vulnerability
MOVEit, CitrixBleed, now this. every time its a web management interface with missing auth on something critical. how are we still shipping admin panels exposed to the open internet in 2025