Reported by 5 outlets
FSB Center 16 Router Targeting Campaign — 13-Nation Joint Advisory Reiterates Threat
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The NSA, FBI, and cyber authorities from twelve partner nations, including Canada, Australia, the UK, and ten other allies, have reissued a joint advisory on FSB Center 16's campaign against edge network devices, and the update is technical detail, not a new bug. Center 16 operators scan the internet for routers and switches running default or weak passwords, then abuse Cisco Smart Install and two named vulnerabilities: CVE-2018-0171, an unauthenticated remote code execution and denial of service flaw in the Smart Install feature of Cisco IOS and IOS XE that Cisco disclosed on March 28, 2018, and CVE-2008-4128, a cross-site request forgery in the HTTP administration component of IOS 12.4 on 871 series routers, published September 18, 2008. The targeting set has not moved in years: defense industrial base, energy, financial services, and healthcare, the same sectors this desk covered on July 10 with the Berserk Bear attribution and July 11 with the LapDogs campaign.
Nothing in this advisory is new except the date, and that is the argument. The same Smart Install flaw was weaponized within ten days of its 2018 disclosure: a group signing itself JHT rewrote configurations on roughly 200,000 routers worldwide, 3,500 of them in Iran, per Iran's ICT ministry, and TA18-106A warned about Russian state actors on routers a week after that. Center 16 still working CVE-2018-0171 and CVE-2008-4128 in 2026 means eight years of monthly patch cycles have not cleared these flaws out of critical infrastructure, and an eighteen-year-old CSRF bug still pays rent on forgotten edge boxes. Any device that still answers on Smart Install has effectively never been patched, so its compromise is an inventory and lifecycle failure, not an intelligence gap. The thirteen-signature list is also the message: allied governments are telling their own operators they share this victim base, and they expect it to persist.
Kill Smart Install outright rather than patching around it: remove the feature with "no vstack", confirm with "show vstack summary", and upgrade IOS and IOS XE to the fixed releases listed in cisco-sa-20180328-smi2. The TA18-106A hunt still works eight years later: alert on any TCP traffic to port 4786, the Smart Install port, that does not originate from a trusted management host, and hold SNMP on 161/162 and HTTP on 80 to the same standard. Purge default and weak credentials on every edge device, rotate local account passwords, and per the advisory watch for unusual credential use and logins through local accounts. Pull current configurations from exposed devices and look for the harvest pattern TA18-106A documented: password hash values and SNMP community strings lifted from stolen config files are what let Center 16 derive legitimate credentials and come back later.
Two developments would change this assessment. A 2026-vintage edge device CVE folding into the same Center 16 toolset would signal active exploitation of current bugs instead of stale ones, which would raise severity sharply. Named victims, sector counts, or exploitation telemetry tied to this advisory would convert a reiteration into an incident and justify emergency exposure sweeps.
Timeline
-
original reporting
FSB Center 16 Router Targeting Campaign — 13-Nation Joint Advisory Reiterates Threat
bleepingcomputer.com · 92d ago · July 14th, 2026
Previously covered: July 10 (GRU/Berserk Bear attribution), July 11 (LapDogs campaign). New: 13 nations issue joint advisory with updated technical details on FSB Center 16's exploitation of vulnerable network devices against critical infrastructure.
The NSA, FBI, and authorities from 12 countries (Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland, Sweden, UK) issued a joint cybersecurity advisory on Russia's FSB Center 16 targeting network infrastructure. The hackers scan the internet for routers with default or weak passwords and exploit Cisco Smart Install and specific CVEs — including CVE-2008-4128 (18 years old) and CVE-2018-0171 — to compromise edge devices.
The advisory recommends disabling Cisco Smart Install, enforcing strong authentication, and monitoring for unusual credentials and logins via local accounts. This follows the pattern of FSB exploitation that has targeted defense industrial base, energy, financial services, and healthcare sectors for over a decade.
-
update from cve.org
CVE-2008-4128: Cisco IOS HTTP administration cross-site request forgery
cve.org · 6599d ago · September 18th, 2008
The CVE record, published 2008-09-18, describes multiple cross-site request forgery vulnerabilities in the HTTP Administration component of Cisco IOS 12.4 on the 871 Integrated Services Router, allowing remote attackers to execute arbitrary commands via crafted requests to the /level/15/exec/- URIs. This is the 18-year-old bug the 2026 joint advisory names alongside CVE-2018-0171.
-
update from cisco.com
Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (cisco-sa-20180328-smi2)
cisco.com · 3122d ago · March 28th, 2018
Cisco's vendor advisory for CVE-2018-0171, dated March 28, 2018, covers the Smart Install remote code execution vulnerability in IOS and IOS XE and lists affected and fixed releases. Verified via its earliest Wayback snapshot from 2018-03-31; the page confirms the March 28, 2018 publication date.
-
update from cve.org
CVE-2018-0171: Cisco IOS and IOS XE Smart Install remote code execution
cve.org · 3121d ago · March 28th, 2018
Published 2018-03-28, the CVE record describes improper validation in the Smart Install feature of Cisco IOS and IOS XE that lets an unauthenticated remote attacker trigger a device reload (denial of service) or execute arbitrary code by sending crafted Smart Install packets. The feature is the core Cisco technology named in the 2026 Center 16 advisory.
-
update from bleepingcomputer.com
Iranian & Russian Networks Attacked Using Cisco's CVE-2018-0171 Vulnerability
bleepingcomputer.com · 3111d ago · April 7th, 2018
In early April 2018, a group signing itself JHT mass-exploited CVE-2018-0171 (Smart Install) and overwrote device configurations on network infrastructure including Russian and Iranian networks. Iran's ICT ministry reported over 200,000 routers affected worldwide, with 3,500 in Iran. This is the earliest large-scale weaponization of the exact flaw the 2026 advisory says Center 16 still uses.
-
update from us-cert.gov
Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices (TA18-106A)
us-cert.gov · 3103d ago · April 16th, 2018
The joint FBI/DHS technical alert, released April 16, 2018, assessed that Russian state-sponsored actors exploited large numbers of enterprise and SOHO routers and switches worldwide, abusing GRE, SNMP (161/162), HTTP (80) and Cisco Smart Install (port 4786), and used compromised routers for man-in-the-middle attacks and persistent access. It advised hunting for TCP traffic to port 4786 from anything other than trusted management hosts and noted attackers harvest password hashes and SNMP community strings from stolen configuration files.
-
update from talosintelligence.com
Beers with Talos EP27: Smart Install, Vuln Process Realities, and Professional Wrestling
talosintelligence.com · 3099d ago · April 20th, 2018
Cisco Talos' podcast episode, published April 20, 2018, discusses the Smart Install exploitation incident and the realities of the vulnerability disclosure process, weeks after CVE-2018-0171 was exploited in the wild. It documents the researcher-side response to the same exploitation wave the 2026 advisory revisits.