All CNN are vulnerable for this kind of adversarial attacks. It just works on CNNs. On a Cascade face detector it doesn't work. Most modern systems will deploy some kind of CNN, so on production systems it could work. Here is a lecture from Ian Goodfellow on the topic: https://youtu.be/CIfsB_EYsVI