CVE-2025-20309
BaseFortify
Publication date: 2025-07-02
Last updated on: 2025-07-03
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | unified_communications_manager | 15.0.1.13010-1 |
| cisco | unified_communications_manager | 15.0.1.13010-1 |
| cisco | unified_communications_manager | 15.0.1.13011-1 |
| cisco | unified_communications_manager | 15.0.1.13011-1 |
| cisco | unified_communications_manager | 15.0.1.13012-1 |
| cisco | unified_communications_manager | 15.0.1.13012-1 |
| cisco | unified_communications_manager | 15.0.1.13013-1 |
| cisco | unified_communications_manager | 15.0.1.13013-1 |
| cisco | unified_communications_manager | 15.0.1.13014-1 |
| cisco | unified_communications_manager | 15.0.1.13014-1 |
| cisco | unified_communications_manager | 15.0.1.13015-1 |
| cisco | unified_communications_manager | 15.0.1.13015-1 |
| cisco | unified_communications_manager | 15.0.1.13016-1 |
| cisco | unified_communications_manager | 15.0.1.13016-1 |
| cisco | unified_communications_manager | 15.0.1.13017-1 |
| cisco | unified_communications_manager | 15.0.1.13017-1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Cisco Unified Communications Manager (Unified CM) and its Session Management Edition (Unified CM SME) Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1. It is caused by static, default root account credentials embedded for development purposes that cannot be changed or deleted. An unauthenticated, remote attacker can exploit this by logging in via SSH using the root account and execute arbitrary commands with root privileges. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is critical. An attacker can remotely and without any authentication log in as the root user, gaining full control over the affected system. This allows the attacker to execute any commands with root privileges, potentially compromising confidentiality, integrity, and availability of the system and its data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for successful SSH logins by the root user in the system logs. Specifically, you can retrieve and inspect the log entries in /var/log/active/syslog/secure using the CLI command: `file get activelog syslog/secure`. Look for log entries indicating sessions opened for user root by uid=0, which are indicators of compromise. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the fixed software updates released by Cisco starting with release 15SU3 (July 2025) or applying the provided patch file (ciscocm.CSCwp27755_D0247-1.cop.sha512). Customers with valid service contracts should obtain updates through normal channels, while those without contracts should contact Cisco TAC with product serial numbers and the advisory URL for free upgrades. There are no available workarounds, so upgrading or patching is essential. [1]