Hundreds of Cisco customers are vulnerable to new Chinese hacking campaign, researchers say | TechCrunch

"Cisco has not said how many of its customers have already been hacked, or may be running vulnerable systems. Now, security researchers say there are hundreds of Cisco customers who could potentially be hacked. Piotr Kijewski, the chief executive of the nonprofit Shadowserver Foundation that scans and monitors the internet for hacking campaigns, told TechCrunch that the scale of exposure "seems more in the hundreds rather than thousands or tens of thousands.""

"Shadowserver has a page where it's tracking the number of systems that are exposed and vulnerable to the flaw disclosed by Cisco, named officially as CVE-2025-20393. The vulnerability is known as a zero-day, because the flaw was discovered before the company had time to make patches available. As of press time, India, Thailand, and the United States collectively have dozens of affected systems within their borders."

Cisco revealed that Chinese government-backed hackers are exploiting a zero-day vulnerability, CVE-2025-20393, in software used by several popular enterprise products. The vulnerability affects Secure Email Gateway and Secure Email and Web Manager. Cisco has not disclosed how many customers have been compromised or are running vulnerable systems. Security researchers and monitoring firms report hundreds of exposed systems rather than widespread thousands. Shadowserver is tracking exposed systems and reports dozens in India, Thailand, and the United States. Censys has observed 220 internet-exposed Cisco email gateways. Current attacks appear targeted rather than broadly distributed.

Read at TechCrunch