PT-2025-27659 · Cisco · Cisco Unified Communications Manager Session Management Edition+1

Published 2025-07-02 · Updated 2026-05-25 · CVE-2025-20309

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (Unified CM) versions 15.0.1.13010-1 through 15.0.1.13017-1 Cisco Unified Communications Manager Session Management Edition (Unified CM SME) versions 15.0.1.13010-1 through 15.0.1.13017-1

Description A vulnerability exists in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) that could allow an unauthenticated, remote attacker to log in to an affected device using the root account. This is due to the presence of static, hardcoded credentials for the root account, which were reserved for development purposes and cannot be modified or deleted. Successful exploitation could grant the attacker root access and the ability to execute arbitrary commands on the system. This vulnerability is actively exploited.

Recommendations Update Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) to version 15SU3 or apply the CSCwp27755 patch immediately.

Fix

RCE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2025-07942

CVE-2025-20309

Affected Products

Cisco Unified Communications Manager

Cisco Unified Communications Manager Session Management Edition

References · 89

• https://bdu.fstec.ru/vul/2025-07942 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20309 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20309 · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1lsxoe1/top_10_trending_cves_06072025 · Reddit Post
• https://twitter.com/TweetThreatNews/status/1940649884702363724 · Twitter Post
• https://twitter.com/CybrPulse/status/1940730371206791271 · Twitter Post
• https://twitter.com/CyberWolfGuard/status/1942274263563559207 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1940586485998407935 · Twitter Post
• https://twitter.com/transilienceai/status/1940632093106884642 · Twitter Post
• https://twitter.com/fridaysecurity/status/1940588137950204243 · Twitter Post
• https://twitter.com/securestep9/status/1940741443762770057 · Twitter Post
• https://twitter.com/modat_magnify/status/1940740064679432352 · Twitter Post
• https://t.me/thedarkwebinformer/18723 · Telegram Post
• https://twitter.com/compuchris/status/1940793260408033518 · Twitter Post