In reply to CVE.

As critical as I was of the original article, the post by 'CVE' is just ill informed.

"Provide the CVE or it doesn’t exist."

Really? Without access to the compromised sites and related logs Cisco would not be able to identify the access vector even if the host was compromised via a well known vulnerability. Each of the sites could have multiple well known vulnerabilities and the unauthorized access could have occurred in slightly different ways for each. There is also the limited possibility of the use of an attack vector that is not publicly known.

I don't know any of the people behind the article, but I imagine that they had two reasons for writing the article:

1. Raise public awareness of a threat with interesting characteristics.

2. Raise awareness of their products and services.

I would hazard to guess that if they knew of the attack vector that publishing it here would support both of those goals. Even without the vulnerability information this article still has value for incident response in that it provides context, scope, and a potential timeline.