A newly disclosed, critical vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) has exposed organizations to the risk of full system compromise.
Tracked as CVE-2025-20309 and assigned a maximum CVSS score of 10.0, the flaw allows unauthenticated remote attackers to gain root access using static, hardcoded SSH credentials that were inadvertently left in production releases.
Vulnerability Details
The issue stems from static user credentials for the root account—credentials reserved for development and never meant to be shipped with production builds.
These credentials cannot be changed or deleted by administrators, making affected systems especially vulnerable.
| Field | Value |
| CVE | CVE-2025-20309 |
| Severity | Critical |
| CVSS Score | 10.0 |
| CWE | 798 (Hard-coded Credentials) |
| Advisory ID | cisco-sa-cucm-ssh-m4UBdpE7 |
| Cisco Bug ID | CSCwp27755 |
| First Published | July 2, 2025 |
An attacker exploiting this flaw can log in remotely over SSH as the root user, granting them the ability to execute arbitrary commands with the highest privileges on the system.
This critical oversight is classified as CWE-798: Use of Hard-coded Credentials. The vulnerability was discovered during Cisco’s internal security testing, and there are currently no reports of exploitation in the wild.
Affected Products
Only a specific subset of Engineering Special (ES) releases is impacted:
- Cisco Unified CM and Unified CM SME ES releases 15.0.1.13010-1 through 15.0.1.13017-1
Earlier versions (12.5, 14) and other releases are not affected.
| Cisco Unified CM Release | Vulnerable? | First Fixed Release / Patch |
| 12.5 | No | Not applicable |
| 14 | No | Not applicable |
| 15.0.1.13010-1 to 15.0.1.13017-1 | Yes | 15SU3 (July 2025) or patch: CSCwp27755_D0247-1 |
Only the listed ES releases are vulnerable. No Service Updates (SUs) for any releases are affected.
Indicators of Compromise
Cisco recommends auditing system logs for evidence of unauthorized root logins via SSH. Specifically, entries in /var/log/active/syslog/secure showing successful root-level SSH sessions are a red flag. Example log entry:
Apr 6 10:38:43 cucm1 sshd: pam_unix(sshd:session): session opened for user root by (uid=0)Administrators can retrieve logs with:
file get activelog syslog/secureNo workarounds are available. Cisco has released free security updates and a patch for affected ES versions. Organizations are urged to:
- Immediately upgrade to Unified CM 15SU3 (July 2025) or apply the CSCwp27755 patch
- Audit access logs for suspicious root logins
- Disable remote access if patching cannot be done immediately
Hardcoded credentials represent a severe supply-chain risk, as they bypass all other authentication controls and can be exploited by anyone with network access.
Immediate action is required to secure affected systems and prevent a potential full compromise of the enterprise communications infrastructure.
Exclusive Webinar Alert: Harnessing Intel® Processor Innovations for Advanced API Security – Register for Free
 and Unified CM Session Management Edition (SME).){kind=link}