GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks
GreyNoise has observed exploitation attempts targeting two Cisco vulnerabilities, CVE-2023-20198 and CVE-2018-0171. CVE-2023-20198 is being actively exploited by over 110 malicious IPs, primarily from Bulgaria, Brazil, and Singapore, while CVE-2018-0171 has seen exploitation attempts from two malicious IPs traced to Switzerland and the United States. These CVEs were referenced in recent reports on Salt Typhoon, a Chinese state-sponsored threat group, though GreyNoise is not attributing the observed exploitation to Salt Typhoon.
- Vendor
- Cisco
- Exploitation
- observed in the wild
Why it ranks 41 (Notable)
- Exploitation observed in the wild
- Covered by 3 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- GreyNoise Labs (greynoise.io)
- CVE-2023-20198 on this site · NVD · CVE.org · Vulnpedia
- CVE-2018-0171 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.