A severe vulnerability in Cisco Unified Communications Manager (Unified CM) systems could allow remote attackers to gain root-level access to affected devices. The vulnerability, designated CVE-2025-20309 with a maximum CVSS score of 10.0, affects Engineering Special releases and stems from hardcoded SSH credentials that cannot be modified or removed by administrators. The vulnerability requires no user interaction and can be exploited remotely without any authentication prerequisites, making it particularly dangerous for organizations with internet-facing Unified CM deployments. CVE-2025-20309 critical severity flaw (CVSS 10.0) with hardcoded SSH root credentials in Cisco Unified CM systems. Suspicious log entries will display successful SSH login attempts by the root user, accompanied by systemd and sshd authentication messages showing session establishment for user root with UID 0. Importantly, Cisco has confirmed that no workarounds exist for this vulnerability, making immediate patching or system updates the only effective mitigation strategy. Only Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1 of Cisco Unified CM and Unified CM SME are vulnerable. Remote attackers gain root access without authentication to execute arbitrary commands.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Jul 2025 08:15:17 +0000