src_0060ae82ad11b5dc16
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Feb 24, 2025 00:00 UTC
- Retrieved
- Oct 08, 2026 03:52 UTC
GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks
GreyNoise has observed exploitation attempts targeting two Cisco vulnerabilities, CVE-2023-20198 and CVE-2018-0171. CVE-2023-20198 is being actively exploited by over 110 malicious IPs, primarily from Bulgaria, Brazil, and Singapore, while CVE-2018-0171 has seen exploitation attempts from two malicious IPs traced to Switzerland and the United States. These CVEs were referenced in recent reports on
Reference details
- Source category
- Research & news
- Report title
GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks- First reported
- Feb 24, 2025 00:00 UTC
- Last reported
- Feb 24, 2025 00:00 UTC
- Catalog updated
- Oct 08, 2026 03:52 UTC
- Record ID
0247ca143c9c6ccfd163ee7d30e3e8b1e39a5c1c8a44ded05be657bb0c9e5b79
CVEs mentioned by sources
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.