Cisco says hackers have been exploiting a critical bug to break into big customer networks since 2023

Core Insights - Cisco has identified a critical vulnerability in its Catalyst SD-WAN products that has been exploited by hackers for at least three years, prompting urgent action from the U.S. government and its allies [1][4] - The vulnerability has a maximum severity score of 10.0, allowing hackers to gain high-level permissions and maintain hidden access to networks, posing significant risks to data security [2][3] Group 1: Vulnerability Details - The bug allows remote access to networks using Cisco's Catalyst SD-WAN products, which are essential for large enterprises and government agencies [1] - Evidence of exploitation dates back to 2023, with affected organizations including critical infrastructure sectors such as power grids and water supply [3] Group 2: Government Response - Multiple governments, including the U.S., Canada, and the UK, have issued warnings about the global targeting of organizations by threat actors [4] - The U.S. cybersecurity agency CISA has mandated that all civilian federal agencies must patch their systems by the end of the week due to the imminent threat [4] Group 3: Ongoing Threats - Cisco has not attributed the attacks to any specific threat group but has tracked a cluster of activity labeled UAT-8616 [5] - In December, Cisco had previously warned about another vulnerability with a severity score of 10.0 in its Async software, which was also being exploited to compromise customer networks [5]