Fast Overview

• More than 150 Cisco devices in Australia continue to be infected with BADCANDY malware.
• Fixes for the flaw have been accessible for over two years.
• Re-infection remains a threat as malicious actors are actively taking advantage of the vulnerability.
• BADCANDY enables attackers to entirely compromise devices and capture network traffic.
• The ASD has marked China’s Salt Typhoon group as one of the malicious actors.
• The vulnerability, CVE-2023-20198, has a top severity rating of 10.0.
• Restarting devices eliminates BADCANDY but does not address the flaw.
• It is essential to implement patches and examine device settings for effective protection.

Overview of BADCANDY Malware

The BADCANDY webshell has consistently posed a threat to Cisco routers and switches within Australia. Despite patches having been available for over two years, as of late October 2025, over 150 devices remain compromised. The Australian Signals Directorate’s Cybersecurity Centre (ACSC-ASD) notes that re-infection is a major concern as malicious actors exploit the flaw.

Technical Insights and Exploitation

The BADCANDY malware exploits a flaw designated as CVE-2023-20198, which carries a maximum severity rating of 10.0. This enables attackers to establish admin accounts, run commands, and gain complete control over the affected devices. Emerged in October 2023, the malware’s ease of use appeals to both criminal and state-sponsored entities, including China’s Salt Typhoon group.

Preventive Strategies and Suggestions

The ACSC-ASD recommends that organizations implement necessary patches and examine device configurations for unusual admin accounts. Investigating the presence of unknown tunnel interfaces is also advised. While rebooting can eliminate the malware, it does not rectify the core vulnerability, requiring additional steps to secure devices.

Conclusion

The persistent existence of BADCANDY malware on Australian Cisco devices highlights the urgent need for alertness and proactive cybersecurity actions. Organizations must take swift measures to patch vulnerabilities and monitor their systems to reduce the risk of re-infection and potential data leaks.

Q: What is BADCANDY malware?

A: BADCANDY is a webshell that takes advantage of a vulnerability in Cisco devices, enabling attackers to control and intercept network traffic.

Q: How critical is the BADCANDY vulnerability?

A: The vulnerability, recognized as CVE-2023-20198, has a maximum severity rating of 10.0, indicating a critical threat.

Q: Who is responsible for the BADCANDY attacks?

A: Both criminal organizations and state-sponsored actors, including China’s Salt Typhoon group, have been known to exploit BADCANDY.

Q: Is it possible to remove BADCANDY by rebooting a device?

A: Rebooting can eliminate the malware, but it does not resolve the underlying vulnerability, leaving devices still exposed.

Q: What steps should organizations undertake to safeguard their devices?

A: Organizations should apply patches, audit admin accounts for suspicious behavior, and fortify their network settings.

Q: Why are numerous devices still infected after two years?

A: Even though patches are available, many devices remain unpatched, with re-infections occurring due to active exploitation by malicious actors.

Quick Overview

• BYD Atto 1 is unveiled as Australia’s most budget-friendly electric vehicle.
• Projected price: A$25,000, a notable reduction from average EV prices.
• Offers two variants: Essential and Premium, each with different battery sizes and features.
• Pre-orders can be made on the BYD Australia official site.
• Incorporates BYD’s sophisticated Blade Battery technology.
• Has the potential to redefine the Australian EV landscape by making EVs more attainable for a larger audience.

Overview

• Samsung smartphones are facing a firmware glitch that obstructs emergency calls.
• Telstra identified the issue, impacting several carriers.
• TPG Telecom was recently made aware of the situation.
• Telecom companies are restricting affected devices unless rectified within 28 days.
• The parliamentary investigation will explore the performance of the triple zero service.
• New regulations by ACMA mandate more rigorous testing for emergency call functionality.

Samsung’s Firmware Predicament

Samsung smartphones configured with firmware that inhibits the ability to make emergency calls are expected to increase. Telstra’s recent finding of this issue has uncovered a major concern that had gone unnoticed by TPG Telecom for more than a year.

Effect on Australian Telecom Providers

TPG Telecom had previously flagged issues related to emergency dialing on Samsung devices, especially regarding VoLTE emergency calls, since 2024. However, these concerns were distinct from the firmware issue identified by Telstra, which impacts all mobile networks utilizing the affected devices. Certain phones might become unusable due to hardcoded configurations.

Technical Issues and Reactions

The malfunctioning firmware locks Samsung devices to Vodafone’s discontinued 3G network, hindering their ability to switch providers for emergency calls. Telstra and Optus have stated intentions to block impacted devices if they are not updated or substituted within 28 days. The number of Samsung mobiles affected by the firmware issue currently totals 71 and is on the rise.

Parliamentary Investigation and Industry Oversight

The parliamentary inquiry will assess the telecommunications sector’s performance regarding the triple zero service. Executives from Optus, Telstra, and others will face difficult inquiries about emergency call breakdowns, including a recent incident tied to fatalities. The inquiry will accept submissions until late November, with reports anticipated by early next February.

ACMA’s Updated Guidelines for Emergency Calls

The Australian Communications and Media Authority (ACMA) has rolled out new guidelines requiring providers to perform specific tests for handsets’ emergency calling capabilities. These rules aim to guarantee that devices can transition between networks for emergency calls, particularly during service disruptions.

Conclusion

The complications surrounding Samsung’s firmware settings that obstruct emergency calls have underscored major issues for the Australian telecom landscape. With a parliamentary inquiry underway and new testing regulations introduced by ACMA, the sector is facing close examination to ensure dependable emergency call services.

Q: What is the primary concern regarding Samsung devices?

A: Samsung devices are encountering a firmware flaw that prevents them from making emergency calls.

Q: Which telecom provider identified the firmware issue?

A: Telstra identified the firmware issue during comprehensive testing.

Q: How are telecom providers addressing this issue?

A: Telstra and Optus have declared they will restrict affected devices unless they are rectified within a 28-day timeframe.

Q: What function does the parliamentary inquiry serve?

A: The inquiry will scrutinize the performance of the telecom sector in delivering stable triple zero services.

Q: What new regulations has ACMA implemented?

A: ACMA has established stricter testing protocols for mobile devices to ensure their effectiveness in making emergency calls.

Q: When are the results of the inquiry expected to be released?

A: The inquiry outcomes are anticipated to be released early next February.