CVE-2025-20309 (GCVE-0-2025-20309)
Vulnerability from cvelistv5
Published
2025-07-02 16:39
Modified
2025-07-03 03:55
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-798 - Use of Hard-coded Credentials
Summary
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
References
psirt@cisco.comhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7Patch, Vendor Advisory
Impacted products
Vendor Product Version
Cisco Cisco Unified Communications Manager Version: 15.0.1.13010-1
Version: 15.0.1.13011-1
Version: 15.0.1.13012-1
Version: 15.0.1.13013-1
Version: 15.0.1.13014-1
Version: 15.0.1.13015-1
Version: 15.0.1.13016-1
Version: 15.0.1.13017-1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20309",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-03T03:55:36.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Unified Communications Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "15.0.1.13010-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13011-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13012-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13013-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13014-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13015-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13016-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13017-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.\r\n\r\nThis vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-02T19:19:10.516Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-cucm-ssh-m4UBdpE7",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7"
        }
      ],
      "source": {
        "advisory": "cisco-sa-cucm-ssh-m4UBdpE7",
        "defects": [
          "CSCwp27755"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Unified Communications Manager Static SSH Credentials Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20309",
    "datePublished": "2025-07-02T16:39:40.392Z",
    "dateReserved": "2024-10-10T19:15:13.253Z",
    "dateUpdated": "2025-07-03T03:55:36.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-20309\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2025-07-02T17:15:52.927\",\"lastModified\":\"2025-07-03T15:23:28.870\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.\\r\\n\\r\\nThis vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en Cisco Unified Communications Manager (Unified CM) y Cisco Unified Communications Manager Session Management Edition (Unified CM SME) podr\u00eda permitir que un atacante remoto no autenticado inicie sesi\u00f3n en un dispositivo afectado utilizando la cuenta ra\u00edz, que tiene credenciales est\u00e1ticas predeterminadas que no se pueden modificar ni eliminar. Esta vulnerabilidad se debe a la presencia de credenciales de usuario est\u00e1ticas para la cuenta ra\u00edz, reservadas para su uso durante el desarrollo. Un atacante podr\u00eda explotar esta vulnerabilidad utilizando la cuenta para iniciar sesi\u00f3n en un sistema afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante iniciar sesi\u00f3n en el sistema afectado y ejecutar comandos arbitrarios como usuario ra\u00edz.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13010-1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"8985BC01-2355-447B-9454-EDCF26817605\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13010-1:*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"2704C9FA-BF67-4776-A1C5-C2FE2D6B79E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13011-1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"71821C29-B31C-4B7B-8C69-2CE1F9C9EE3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13011-1:*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"E0C338F5-3710-42B0-8959-73A916638EC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13012-1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"3E128057-726A-4715-B9EF-2C2AC30EDD17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13012-1:*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"8A05CB62-B48C-4205-8349-8C4F3AFCB9D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13013-1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"6012779F-6406-4882-B520-3CB71734AAC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13013-1:*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"3ED47A6A-D9E9-4FC1-846D-E8481194B003\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13014-1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"B2BD7E64-746B-46F8-A676-A26B773159CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13014-1:*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"7EA03C5C-40DF-4AE6-B6B9-7A6D38918B97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13015-1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"B2A4642A-D12B-40A9-B835-3F7303020209\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13015-1:*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"429174E3-5F75-43E7-95FF-C2FDE91E7BB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13016-1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"17D01F03-DA41-4F79-BC20-3F8D2B1BA7F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13016-1:*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"F645ECD4-D63F-4405-80CD-DF9F0C14DEDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13017-1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"5ACF28F0-7049-4AB8-8DBF-50FDC65194A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13017-1:*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"2C88F71F-229C-40BE-82EC-F76347AC5FDA\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20309\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-02T19:38:57.879572Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-02T19:39:00.763Z\"}}], \"cna\": {\"title\": \"Cisco Unified Communications Manager Static SSH Credentials Vulnerability\", \"source\": {\"defects\": [\"CSCwp27755\"], \"advisory\": \"cisco-sa-cucm-ssh-m4UBdpE7\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Unified Communications Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"15.0.1.13010-1\"}, {\"status\": \"affected\", \"version\": \"15.0.1.13011-1\"}, {\"status\": \"affected\", \"version\": \"15.0.1.13012-1\"}, {\"status\": \"affected\", \"version\": \"15.0.1.13013-1\"}, {\"status\": \"affected\", \"version\": \"15.0.1.13014-1\"}, {\"status\": \"affected\", \"version\": \"15.0.1.13015-1\"}, {\"status\": \"affected\", \"version\": \"15.0.1.13016-1\"}, {\"status\": \"affected\", \"version\": \"15.0.1.13017-1\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7\", \"name\": \"cisco-sa-cucm-ssh-m4UBdpE7\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.\\r\\n\\r\\nThis vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-798\", \"description\": \"Use of Hard-coded Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2025-07-02T19:19:10.516Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-20309\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-02T19:39:06.786Z\", \"dateReserved\": \"2024-10-10T19:15:13.253Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2025-07-02T16:39:40.392Z\", \"assignerShortName\": \"cisco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.