In a new blog post, Cisco said it found evidence of Salt Typhoon abusing CVE-2018-0171, a 9.8/10 (critical) vulnerability that allows threat actors to execute arbitrary code on an

Cisco has confirmed that its networking products were compromised by Salt Typhoon's attacks against American telecommunication networks. Major American telecoms use Cisco devices and software.

The Chinese hacking collective has widely leveraged vulnerabilities in communications infrastructure to breach dozens of telecom providers in the U.S. and overseas.

Chinese threat actor Salt Typhoon used JumbledPath, a custom-built utility, to gain access to a remote Cisco device, said the network provider

Cisco Talos observed Chinese hackers team pivoting from a compromised device operated by one telecom to target a device in another telecom.

The Chinese state-sponsored Salt Typhoon hacking group uses a custom utility called JumbledPath to stealthily monitor network traffic and potentially capture sensitive data in cyberattacks on U.S. telecommunication providers.

Discover how the Salt Typhoon cyberattack exploits vulnerabilities in Cisco devices, posing a significant threat to network security.

In research published Thursday on Salt Typhoon's hacking campaign against telecom carriers, Cisco Talos said the Chinese state-sponsored threat group had gained access to Cisco devices through compromised login credentials and that no new vulnerabilities were discovered during investigation.

Salt Typhoon exploited CVE-2018-0171 and stolen credentials to infiltrate U.S. telecom networks, persisting undetected for over three years.

Threat intelligence firm Recorded Future said it had observed Salt Typhoon breaching 5 telcos between December 2024 and January 2025.