A sophisticated cyberattack campaign exploited a critical vulnerability in Cisco's software-defined networking products for months before the flaw was publicly disclosed, according to a new report.