A newly disclosed, critical vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) has exposed organizations to the risk of full system compromise.
Tracked as CVE-2025-20309 and assigned a maximum CVSS score of 10.0, the flaw allows unauthenticated remote attackers to gain root access using static, hardcoded SSH credentials that were inadvertently left in production releases.
The issue stems from static user credentials for the root account—credentials reserved for development and never meant to be shipped with production builds.
These credentials cannot be changed or deleted by administrators, making affected systems especially vulnerable.
| Field | Value |
| CVE | CVE-2025-20309 |
| Severity | Critical |
| CVSS Score | 10.0 |
| CWE | 798 (Hard-coded Credentials) |
| Advisory ID | cisco-sa-cucm-ssh-m4UBdpE7 |
| Cisco Bug ID | CSCwp27755 |
| First Published | July 2, 2025 |
An attacker exploiting this flaw can log in remotely over SSH as the root user, granting them the ability to execute arbitrary commands with the highest privileges on the system.
This critical oversight is classified as CWE-798: Use of Hard-coded Credentials. The vulnerability was discovered during Cisco’s internal security testing, and there are currently no reports of exploitation in the wild.
Affected Products
Only a specific subset of Engineering Special (ES) releases is impacted:
Earlier versions (12.5, 14) and other releases are not affected.
| Cisco Unified CM Release | Vulnerable? | First Fixed Release / Patch |
| 12.5 | No | Not applicable |
| 14 | No | Not applicable |
| 15.0.1.13010-1 to 15.0.1.13017-1 | Yes | 15SU3 (July 2025) or patch: CSCwp27755_D0247-1 |
Only the listed ES releases are vulnerable. No Service Updates (SUs) for any releases are affected.
Indicators of Compromise
Cisco recommends auditing system logs for evidence of unauthorized root logins via SSH. Specifically, entries in /var/log/active/syslog/secure showing successful root-level SSH sessions are a red flag. Example log entry:
Apr 6 10:38:43 cucm1 sshd: pam_unix(sshd:session): session opened for user root by (uid=0)Administrators can retrieve logs with:
file get activelog syslog/secureNo workarounds are available. Cisco has released free security updates and a patch for affected ES versions. Organizations are urged to:
Hardcoded credentials represent a severe supply-chain risk, as they bypass all other authentication controls and can be exploited by anyone with network access.
Immediate action is required to secure affected systems and prevent a potential full compromise of the enterprise communications infrastructure.
Exclusive Webinar Alert: Harnessing Intel® Processor Innovations for Advanced API Security – Register for Free
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…