Critical Vulnerability in Cisco Product Allows Unauthorized Access

Details

Cisco has just issued a warning about a critical vulnerability – CVE-2025-20309 – affecting Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). This vulnerability allows an unauthenticated attacker to access the system with root privileges through a default account that is hardcoded and cannot be changed or deleted.

CVE Code: CVE-2025-20309
Severity Level: High Risk (CVSS v3: 10)
Impact: Allows a remote attacker without authentication to log into the system with root privileges through the SSH port.

Affected Products

Cisco Unified CM and Unified CM SME Engineering Special (ES) versions from 15.0.1.13010-1 to 15.0.1.13017-1 are affected.

Cisco Unified CM & SME Release	Fixed Version
12.5	Not vulnerable
14	Not vulnerable
15.0.1.13010-1 → 13017-1	15SU3 (07/2025) or apply patch: `ciscocm.CSCwp27755_D0247-1.cop.sha512`

Exploitation Potential and Indicators of Compromise (IoC)

This vulnerability allows an attacker to:

Access the system with root privileges
Install malware and gain unauthorized access to sensitive data
Move laterally to expand the attack within the internal system

Indicators of Compromise (IoC) include log records showing successful SSH login using the root account in the file /var/log/active/syslog/secure. Cisco advises customers to check their systems using the following CLI command:

```
      file get activelog syslog/secure
```
Successful exploitation will be recorded in the file /var/log/active/syslog/secure with an SSH login from the root user.

Example log indicating an Indicator of Compromise (IoC):

    Apr 6 10:38:43 xxx authpriv 6 sshd: pam_unix(sshd:session): session opened for user root by (uid=0)

Recommendations

FPT Threat Intelligence urgently recommends the following measures to address the vulnerability:

Update the patch immediately:
- Cisco has released an update to fix the affected products.
- Visit the Cisco Security Advisory page to download the appropriate patch.
Check and monitor SSH connections:
- Review unusual SSH connections to the device.
- Ensure there is no unauthorized access using static accounts.
Disable SSH if not in use:
- For systems that do not require SSH, disable it to reduce the attack surface.
Reevaluate account management policies:
- Avoid using hardcoded accounts.
- Use strong authentication (multi-factor authentication) if possible.
Enhance log monitoring and alerts:
- Connect the system to SIEM to track unusual behavior.
- Set up alerts for root access via SSH.

Critical Vulnerability in Cisco Product Allows Unauthorized Access

Comments

Newsletters-eng

More from this blog

MedusaHVNC: "Màn hình Windows vô hình" đang giúp tin tặc qua mặt mọi ánh mắt giám sát

MedusaHVNC: "Invisible Windows screen" is helping hackers bypass all surveillance eyes

SourTrade: Chiến dịch biến JavaScript thành dây chuyền sản xuất mã độc

SourTrade: Campaign to turn JavaScript into a malware production line

Bạn Kết Nối Wi-Fi Khách Sạn, Kẻ Tấn Công Đã Vào Tài Khoản Microsoft 365 — Mà Bạn Không Nhấp Gì Cả

Details

Affected Products

Exploitation Potential and Indicators of Compromise (IoC)

Recommendations

References

Command Palette

Comments

Newsletters-eng

More from this blog

Details

Affected Products

Exploitation Potential and Indicators of Compromise (IoC)

Recommendations

References