CVE-2025-20309

Published Jul 2, 2025

Last updated 14 days ago

Cisco

Unified CM

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-20309 is a vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). It could allow an unauthenticated, remote attacker to log in to an affected device using the root account. The root account has default, static credentials that cannot be changed or deleted. The vulnerability exists because of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the root account to log in to an affected system. Successful exploitation could allow the attacker to log in to the affected system and execute arbitrary commands as the root user. This vulnerability affects Cisco Unified CM and Unified CM SME Engineering Special (ES) releases 15.0.1.13010-1 through 15.0.1.13017-1, regardless of device configuration.

Description: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
Source: psirt@cisco.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@cisco.com: CWE-798

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13010-1:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8985BC01-2355-447B-9454-EDCF26817605"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13010-1:*:*:*:session_management:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2704C9FA-BF67-4776-A1C5-C2FE2D6B79E1"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13011-1:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "71821C29-B31C-4B7B-8C69-2CE1F9C9EE3A"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13011-1:*:*:*:session_management:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E0C338F5-3710-42B0-8959-73A916638EC5"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13012-1:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3E128057-726A-4715-B9EF-2C2AC30EDD17"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13012-1:*:*:*:session_management:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8A05CB62-B48C-4205-8349-8C4F3AFCB9D2"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13013-1:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6012779F-6406-4882-B520-3CB71734AAC8"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13013-1:*:*:*:session_management:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3ED47A6A-D9E9-4FC1-846D-E8481194B003"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13014-1:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B2BD7E64-746B-46F8-A676-A26B773159CB"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13014-1:*:*:*:session_management:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7EA03C5C-40DF-4AE6-B6B9-7A6D38918B97"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13015-1:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B2A4642A-D12B-40A9-B835-3F7303020209"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13015-1:*:*:*:session_management:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "429174E3-5F75-43E7-95FF-C2FDE91E7BB7"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13016-1:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "17D01F03-DA41-4F79-BC20-3F8D2B1BA7F3"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13016-1:*:*:*:session_management:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F645ECD4-D63F-4405-80CD-DF9F0C14DEDF"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13017-1:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5ACF28F0-7049-4AB8-8DBF-50FDC65194A5"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:15.0.1.13017-1:*:*:*:session_management:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2C88F71F-229C-40BE-82EC-F76347AC5FDA"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.