Hackers exploit flaw in two million Cisco devices

Cisco confirmed attackers gained access by compromising administrator credentials, urging immediate upgrades to patched software releases.
Hackers have exploited a flaw affecting up to two million Cisco devices, allowing malware infections and remote command execution.

Hackers have targeted up to two million Cisco devices using a newly disclosed vulnerability in the company’s networking software. The flaw, tracked as CVE-2025-20352, affects all supported versions of Cisco IOS and IOS XE, which power many routers and switches.

Cisco confirmed that attackers have exploited the weakness in the wild, crashing systems, implanting malware, and potentially extracting sensitive data. The campaign builds on previous activity by the same threat group, which has also exploited Cisco Adaptive Security Appliance devices.

Attackers gained access after local administrator credentials were compromised, allowing them to implant malware and execute commands. The company’s Product Security Incident Response Team urged customers to upgrade immediately to fixed software releases to secure their systems.

The Canadian Centre for Cyber Security has warned organisations about sophisticated malware exploiting flaws in outdated Cisco ASA devices, urging immediate patching and stronger defences to protect critical systems.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!