Security researchers estimate that hundreds of Cisco customers may be at risk due to a newly disclosed vulnerability, CVE-2025-20393, which is being exploited by hackers linked to the Chinese government. Cisco has not provided specific figures regarding the number of compromised clients or those running potentially vulnerable systems.
According to Piotr Kijewski, CEO of the Shadowserver Foundation, the current scope of exposed systems appears to be in the hundreds. His organization is tracking the affected systems, but noted that the attacks seem to be highly targeted rather than widespread.
As of now, a limited number of affected systems have been identified in India, Thailand, and the United States. Additionally, cybersecurity firm Censys has reported finding 220 internet-exposed Cisco email gateways that are susceptible to the flaw. Cisco's vulnerability primarily affects systems with the "spam quarantine" feature enabled, which is not set by default.
While Cisco issued a security advisory detailing the issue, it has yet to provide patches, raising concerns about the ongoing risks for its enterprise customers.