A zero-day vulnerability in Huawei enterprise router software caused a three-hour nationwide telecommunications outage across Luxembourg in 2025, according to sources speaking with The Record.
The incident represents a significant breach of critical infrastructure, affecting connectivity across the entire country. The attack exploited a previously unknown vulnerability in Huawei's router software, bypassing existing security measures and disrupting services for multiple telecommunications providers.
Luxembourg's telecommunications network relies on interconnected infrastructure managed by several carriers. The three-hour duration of the outage suggests the vulnerability allowed attackers sustained access to core routing systems before the issue was identified and mitigated.
Zero-day vulnerabilities—flaws unknown to the vendor and the security community—are particularly dangerous in infrastructure settings. Once exploited, they provide attackers with an advantage until patches are developed and deployed. The fact that this vulnerability affected router software used nationwide indicates potential exposure across multiple operators and service providers.
The incident underscores ongoing concerns about supply chain security in telecommunications. Huawei equipment is widely deployed in European networks, making vulnerabilities in its software a matter of regional interest. Some countries have restricted or scrutinized Huawei deployments, citing security and geopolitical concerns.
Details about who carried out the attack and the specific nature of the vulnerability remain unclear. The source of the attack—whether state-sponsored, criminal, or otherwise—has not been disclosed. Huawei's response to the incident and any public disclosure of the vulnerability are also not confirmed.
Telecommunications outages of this scale typically trigger investigations by relevant authorities. Luxembourg's regulators and telecommunications operators would likely conduct forensic analysis to understand how the attack occurred and what data, if any, was compromised.
The incident adds to a growing list of infrastructure attacks exploiting software vulnerabilities in critical systems. As telecommunications networks become increasingly complex and interconnected, the consequences of successful cyberattacks continue to expand.
Anthropic has signed out some Claude users and removed saved payment methods after infostealer malware on their computers hijacked active sessions to drain API usage credits. The company is issuing refunds for unauthorized charges.
Former NYC Traffic Commissioner Sam Schwartz warns that autonomous vehicle expansion creates significant cybersecurity risks, including the potential for bad actors to seize control of connected cars and weaponize them.
More than a decade of Steam files, including beta builds and finished games from Valve and third-party developers, have been exposed in a major data leak totaling over 12 terabytes.
A new vulnerability called Omarchy allows any user-level process to gain root privileges through privilege escalation. The flaw has sparked significant discussion in security circles.