Cisco Scores a Perfect 10 for a Critical Comms Flaw
NO LOC, JUL 2 – The vulnerability allows unauthenticated remote attackers to gain root access via hardcoded SSH credentials in Cisco Unified CM, rated CVSS 10.0 with patches due in July 2025.
- On July 3, 2025, Cisco issued a security advisory highlighting a severe vulnerability impacting specific Engineering Special versions of its Unified Communications Manager and the related Session Management Edition.
- The vulnerability arises from hardcoded root credentials meant for development that remain unchangeable and allow unauthenticated remote attackers root access.
- Cisco confirmed no exploitation in the wild but warned that a successful attack enables arbitrary root commands and encouraged admins to check logs for suspicious SSH root logins.
- Administrators must either update their systems to the latest Unified CM and Unified CM SME 15SU3 release scheduled for July 2025 or obtain the CSCwp27755 patch through Cisco's Technical Assistance Center, as no alternative fixes are available; according to Cisco, upgrading to the most recent software version is the only effective remedy.
- This flaw, CVE-2025-20309, rated a maximum CVSS score of 10.0, joins recent critical fixes in Cisco products, highlighting persistent risks from leftover development credentials in live systems.
15 Articles
15 Articles
BleepingComputer
cybernoz.comCisco warns that Unified CM has hardcoded root SSH credentials
Cisco has removed a backdoor account from its Unified Communications Manager (Unified CM), which would have allowed remote attackers to log in to unpatched devices with root privileges.
Global Security Mag OnlineGlobal Security Mag OnlineA vulnerability has been discovered in Cisco products. It allows an attacker to cause a circumvention of security policy. See online: https://www.cert.ssi.gouv.fr/avis/C...
Cisco fixes maximum-severity flaw in enterprise unified comms platform (CVE-2025-20309) - Help Net Security
Cisco has found a backdoor account in yet another of its software solutions: CVE-2025-20309, stemming from default credentials for the root account, could allow unauthenticated remote attackers to log into a vulnerable Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) platforms and use the acquired access to execute arbitrary commands with the highest privileges…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
