A Russia-sponsored campaign is targeting end-of-life devices via a seven-year-old vulnerability.