How SS7, BGP, and Router Weaknesses Expose Telecom Networks to Intrusions
Summary
An explainer on how weaknesses in telecom signaling, internet routing, and network routers can enable surveillance and persistent intrusions, and outlines defenses including SS7 firewalls, RPKI validation, and router audits.
Key points
- SS7 lacks built-in authorization checks, enabling signaling-access holders to track subscribers or redirect SMS; Diameter and roaming downgrade risks also affect newer networks.
- The article says leased Global Titles, weakly vetted roaming partners, and compromised operators can provide SS7 access, while underground forums continue to discuss SS7 and Diameter exploits.
- BGP does not inherently verify route origins; the article cites a 2010 incident in which erroneous routes reportedly diverted traffic for about 18 minutes.
- A 2025 joint advisory described PRC state-sponsored actors targeting telecom routers and using compromised devices and trusted connections to move into other networks.
- The advisory cited exploitation of known Ivanti, Palo Alto, and Cisco vulnerabilities; the article says Salt Typhoon implanted code on network devices and used GRE tunnels to extract data.
- Recommended defenses include SS7 and Diameter firewalls, strict partner vetting, RPKI route-origin validation, prompt patching, and audits of tunnels and router configurations.
Article Details
- Topic
- Telecom attack surfaces involving SS7, Diameter, BGP, and persistent router intrusions
MITRE ATT&CK
CVE
CVE-2023-20198Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieve root-level code execution.CVE-2023-20273CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieveCVE-2023-46805The advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XECVE-2024-21887The advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XECVE-2024-3400in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained
People
Threat Actors
Vendors
Ciscoauthentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieve root-level codeCybleCyble’s dark web researchers have confirmed that SS7 and Diameter exploits and services are still routinely discussed on underground forums, including detailed attack exploits.IvantiThe advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XEPalo Alto NetworksConnect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the
Products
Cisco IOS XEbypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieve root-level codeCyble VisionWhere Cyble Vision Fits GlobalProtectchained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198Ivanti Connect SecureThe advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XEPAN-OSSecure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198
Countries
Chinacarriers are vulnerable to SS7 and Diameter exploits, and a DHS presentation named Russia, China, Israel and Iran as the primary countries reportedly using other nations’ telecom assets to exploit U.S.Irancarriers are vulnerable to SS7 and Diameter exploits, and a DHS presentation named Russia, China, Israel and Iran as the primary countries reportedly using other nations’ telecom assets to exploit U.S.Israelcarriers are vulnerable to SS7 and Diameter exploits, and a DHS presentation named Russia, China, Israel and Iran as the primary countries reportedly using other nations’ telecom assets to exploit U.S.Russiacarriers are vulnerable to SS7 and Diameter exploits, and a DHS presentation named Russia, China, Israel and Iran as the primary countries reportedly using other nations’ telecom assets to exploit U.S.United StatesU.S. government assessments are blunt.