Archive — US — techcrunch
Cisco says Chinese hackers are exploiting its customers with a new zero-day
Cisco has reported a zero-day vulnerability being exploited by Chinese hackers in its popular products, allowing complete control over affected devices. No patches exist yet, and affected customers are advised to wipe and rebuild their software. The campaign has targeted Cisco AsyncOS since December, exploiting internet-facing features, which limits the attack surface.
Key points
- Cisco identified a zero-day vulnerability affecting its AsyncOS software and related appliances on December 10.
- The hackers can take full control of affected devices, which have an internet-accessible feature called 'Spam Quarantine' enabled.
- Security experts highlight that not all devices are vulnerable due to the need for certain features to be enabled and exposed.
- Cisco has no patches available; the recommended action is to wipe and rebuild affected devices' software.
- The hacking campaign is believed to be linked to Chinese government hacking groups and began around late November 2025.
Why it matters
- This incident reflects ongoing cybersecurity threats from state-sponsored hackers, particularly from China.
- Current IT trends focus heavily on zero-day vulnerabilities, which have significant impact due to their exploitation before patches are available.
- Organizations must increasingly prioritize cybersecurity frameworks to safeguard against advanced persistent threats (APTs).
The active exploitation of Cisco's vulnerabilities underscores the urgent need for enhanced cybersecurity measures as organizations face persistent threats from state-sponsored actors, particularly in the context of ever-evolving IT security challenges.