Breaking News

Chinese Hackers Actively Exploiting Zero-Day, Says Cisco

by VARINDIA 2025-12-20

Cisco has said hackers linked to China are actively exploiting a critical zero-day vulnerability in several of its widely used email security products, potentially allowing attackers to gain full control of affected systems.

Cisco said it detected an ongoing hacking campaign targeting its AsyncOS software on December 10. The attacks specifically affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances, both physical and virtual.

According to Cisco, the vulnerability can be exploited when the “Spam Quarantine” feature is enabled and the affected devices are accessible from the internet. While the feature is not enabled by default and does not need to be internet-facing, exposed systems remain at risk.

“The requirement of an internet-facing management interface and certain features being enabled will limit the attack surface for this vulnerability,” said Michael Taggart, senior cybersecurity researcher at UCLA Health Sciences.

However, security researchers have raised concerns about the scale and severity of the campaign. Kevin Beaumont, an independent security researcher who tracks state-sponsored hacking activity, said the situation is particularly serious given the widespread use of the affected products, the absence of available patches, and the uncertainty around how long attackers may have maintained access to compromised systems.

Cisco has not disclosed how many customers may have been affected. When contacted, the company said it is actively investigating the issue and working on a permanent fix. In the absence of a patch, Cisco has advised customers to wipe and rebuild affected systems if compromise is confirmed. “Rebuilding the appliances is, currently, the only viable option to eradicate the threat actors’ persistence mechanism from the appliance,” the company said.

Cisco Talos, the company’s threat intelligence division, linked the campaign to Chinese state-backed hacking groups. Researchers said attackers are exploiting the zero-day vulnerability to deploy persistent backdoors, noting that the campaign has been active since at least late November 2025.