# PRC state-sponsored actors exploit network device CVEs widely

Published: 2025-06-20 · Severity: high · Sectors: telecommunications, government-national, defense, financial-services, healthcare, energy, infrastructure
Canonical: https://vorant.io/reports/43fb4355-ba27-5638-9314-2936a6afdf9d/prc-state-sponsored-actors-exploit-network-device-cves-widely

> Chinese state-sponsored cyber actors exploit known vulnerabilities in network devices to compromise telecommunications providers and route traffic to attacker infrastructure.

This joint advisory from NSA, CISA, and FBI describes how People's Republic of China state-sponsored cyber actors have systematically exploited publicly known vulnerabilities in network devices since 2020 to establish a broad infrastructure for compromising targets worldwide. The actors target telecommunications companies and network service providers, using SOHO routers, NAS devices, and VPN gateways as access points and obfuscation nodes. They employ publicly available tools like RouterSploit and RouterScan for reconnaissance, then leverage CVEs to gain initial access before pivoting to critical network infrastructure.

Once inside, the actors identify and compromise RADIUS servers to extract credentials, then use those credentials to access network devices like Cisco and Juniper routers. They execute configuration commands to establish tunnels, enable port mirroring, and exfiltrate traffic to actor-controlled infrastructure while destroying log evidence. The advisory identifies 17 specific CVEs affecting Cisco, Citrix, DrayTik, D-Link, Fortinet, MikroTik, Netgear, Pulse, QNAP, and Zyxel devices as the most frequently exploited since 2020. The threat is ongoing and active; defenders must prioritize patching these devices, implementing MFA, segmenting networks, and disabling unnecessary services.

## Mentioned in this report

- Vulnerabilities: CVE-2017-6862 (KEV), CVE-2018-0171 (KEV), CVE-2018-13382 (KEV), CVE-2018-14847 (KEV), CVE-2019-11510 (KEV), CVE-2019-15271 (KEV), CVE-2019-1652 (KEV), CVE-2019-16920 (KEV), CVE-2019-19781 (KEV), CVE-2019-7192 (KEV), CVE-2019-7193 (KEV), CVE-2019-7194 (KEV), CVE-2019-7195 (KEV), CVE-2020-29583 (KEV), CVE-2020-8515 (KEV), CVE-2021-22893 (KEV)
- Threat actors: China-nexus activity (unattributed)

## Detection guidance (public sample)

### Cisco Device Port Mirroring or Tunnel Configuration via Logged CLI Command

ATT&CK: T1020.001

Detects logged Cisco IOS config commands that set up SPAN/ERSPAN port mirroring or GRE tunnels, as used to duplicate and exfiltrate traffic to external infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco Device Port Mirroring or Tunnel Configuration via Logged CLI Command
description: Detects Cisco IOS configuration commands (CFGLOG_LOGGEDCMD) that create
  SPAN/ERSPAN monitor sessions or GRE tunnels. State-sponsored actors with stolen
  network-device credentials used these to mirror traffic and send it to actor-controlled
  hosts. Requires command logging (archive log config logging) to be enabled.
tags:
- attack.exfiltration
- attack.t1020.001
- attack.command-and-control
- attack.t1572
logsource:
  product: cisco
  service: syslog
detection:
  selection_cfglog:
  - CFGLOG_LOGGEDCMD
  selection_cmd:
  - monitor session
  - erspan
  - tunnel mode gre
  - tunnel destination
  condition: selection_cfglog and selection_cmd
falsepositives:
- Network engineers legitimately configuring SPAN sessions for IDS/packet capture
  or GRE tunnels during approved change windows
level: medium
id: bf5187be-4bdc-5e01-b116-ab438189f886
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a
```

### Cisco Device Logging Disabled or Cleared via Logged CLI Command

ATT&CK: T1599

Detects logged Cisco IOS config commands that disable logging or clear the log buffer, consistent with actors removing evidence after reconfiguring network devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco Device Logging Disabled or Cleared via Logged CLI Command
description: Detects Cisco IOS commands logged via CFGLOG_LOGGEDCMD that disable logging
  destinations or clear the logging buffer. Actors who compromised network devices
  through stolen RADIUS-derived credentials cleared logs to hide tunnel and port-mirroring
  changes.
tags:
- attack.stealth
- attack.defense-impairment
- attack.t1070
- attack.t1599
logsource:
  product: cisco
  service: syslog
detection:
  selection_cfglog:
  - CFGLOG_LOGGEDCMD
  selection_cmd:
  - no logging
  - clear logging
  condition: selection_cfglog and selection_cmd
falsepositives:
- Administrators resetting the log buffer or changing syslog hosts during troubleshooting
  or device decommissioning
level: medium
id: 395db1a6-f215-5550-b7bb-31292e20ff4c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a
```

### Linux Execution of RouterSploit Router Exploitation Framework

ATT&CK: T1595.002

Detects execution of the RouterSploit framework (rsf.py), a publicly available tool used for reconnaissance and exploitation of network device CVEs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Execution of RouterSploit Router Exploitation Framework
description: Detects process creation with RouterSploit entry points (rsf.py or routersploit
  module). The advisory describes actors using RouterSploit to scan and exploit SOHO
  routers, NAS devices and VPN gateways.
tags:
- attack.reconnaissance
- attack.t1595.002
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_script:
    CommandLine|contains:
    - rsf.py
    - routersploit
  selection_interp:
    Image|contains: python
  selection_direct:
    Image|endswith: /rsf.py
  condition: (selection_script and selection_interp) or selection_direct
falsepositives:
- Authorized penetration testers or red teams running RouterSploit against in-scope
  devices
- Security researchers using RouterSploit in lab hosts
level: medium
id: 8c60fb56-0583-5442-af0a-371f8ff4572a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/43fb4355-ba27-5638-9314-2936a6afdf9d/prc-state-sponsored-actors-exploit-network-device-cves-widely.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup