Grey Noise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks
Summary: GreyNoise's global observation grid detected malicious exploitation attempts against two Cisco vulnerabilities that were referenced in recent reports on Salt Typhoon, the Chinese state-sponsored espionage group targeting Cisco devices. Between December 2024 and January 2025, Salt Typhoon reportedly used CVE-2023-20198 and CVE-2023-20273 to compromise five additional telecom networks, including entities in the United States, and has also exploited CVE-2018-0171 and legitimate login credentials.
What you should know: GreyNoise states plainly that it is not attributing the exploitation it observed to Salt Typhoon, only confirming it is happening - so the question for defenders is whether Cisco edge devices in their estate are exposed to the same CVEs a state group has already used against five telecom networks.