China's Cyber War on Taiwan Intensifies; Critical Flaws in IoT and Enterprise Software Actively Exploited

New information reveals that Xspeeder, the vendor of SXZOS firmware, has been unresponsive for over seven months to disclosure attempts for CVE-2025-54322. The vulnerability now has a confirmed CVSS score of 10.0, making it a critical, unpatched RCE flaw. This lack of vendor support means no official patch is available, significantly increasing the risk to affected organizations. Researchers at Pwn.ai, who publicly disclosed the flaw, also claim it was discovered using an AI agent. Due to the vendor's unresponsiveness, the primary remediation advice is now to isolate or replace affected devices, as patching is not an option.

New information confirms that the Clop extortion group has not only claimed responsibility but also leaked the stolen employee data from Korean Air. Crucially, the Oracle E-Business Suite zero-day vulnerability, central to this attack, was actively exploited by Clop for several months, beginning in August 2025, before a patch was available. This prolonged exploitation window allowed Clop to compromise numerous organizations globally, indicating a much wider impact of this campaign than initially reported. Clop's primary objective in this campaign is now understood to be data theft and extortion, rather than traditional ransomware deployment.