Hundreds of Cisco customers are vulnerable to new Chinese hacking campaign, researchers say

On Wednesday, Cisco revealed that a radical of Chinese government-backed hackers is exploiting a vulnerability to people its endeavor customers who usage immoderate of the company’s astir fashionable products.

Cisco has not said however galore of its customers person already been hacked, oregon whitethorn beryllium moving susceptible systems. Now, information researchers accidental determination are hundreds of Cisco customers who could perchance beryllium hacked.

Piotr Kijewski, the main enforcement of the nonprofit Shadowserver Foundation that scans and monitors the net for hacking campaigns, told TechCrunch that the standard of vulnerability “seems much successful the hundreds alternatively than thousands oregon tens of thousands.”

Kijewski said the instauration was not seeing wide activity, presumably due to the fact that “current attacks are targeted.” 

Shadowserver has a page wherever it’s tracking the fig of systems that are exposed and susceptible to the flaw disclosed by Cisco, named officially arsenic CVE-2025-20393. The vulnerability is known arsenic a zero-day, due to the fact that the flaw was discovered earlier the institution had clip to marque patches available. As of property time, India, Thailand, and the United States collectively person dozens of affected systems wrong their borders.

Censys, a cybersecurity steadfast that monitors hacking activities crossed the internet, is besides seeing a constricted fig of affected Cisco customers. According to a blog post, Censys has observed 220 internet-exposed Cisco email gateways, 1 of the products known to beryllium vulnerable.  

In its information advisory published earlier this week, Cisco said that the vulnerability is contiguous successful bundle recovered successful respective products, including its Secure Email Gateway and its Secure Email and Web Manager.

Cisco said these systems are lone susceptible if they are reachable from the internet, and person its “spam quarantine” diagnostic enabled. Neither of those 2 conditions are enabled by default, per Cisco, which would explicate wherefore determination appears to be, comparatively speaking, not that galore susceptible systems connected the internet. 

Cisco did not respond to a petition for comment, asking if the institution could corroborate the numbers seen by Shadowserver and Censys. 

The bigger occupation with this hacking run is that determination are nary patches available. Cisco recommends that customers hitch and “restore an affected appliance to a unafraid state,” arsenic a mode to remediate immoderate breach. 

“​​In lawsuit of confirmed compromise, rebuilding the appliances is, currently, the lone viable enactment to eradicate the menace actors persistence mechanics from the appliance,” the institution wrote successful its advisory. 

According to Cisco’s menace quality limb Talos, the hacking run has been ongoing since “at slightest precocious November 2025.”