Cisco

A critical vulnerability in Cisco Unified Communications Manager (Unified CM) systems allows remote attackers to gain root-level access. The flaw, CVE-2025-20309, stems from hardcoded SSH credentials that cannot be modified. Affected are Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1. Attackers can exploit this to execute arbitrary commands without authentication, posing a severe risk to organizations with internet-facing Unified CM deployments. Immediate patching or system updates are recommended.

Source: https://cybersecuritynews.com/cisco-unified-cm-vulnerability/

TPRM report: https://scoringcyber.rankiteo.com/company/cisco

"id": "cis356070325",
"linkid": "cisco",
"type": "Vulnerability",
"date": "7/2025",
"severity": "100",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Networking and Communications',
                        'name': 'Cisco',
                        'type': 'Technology Company'}],
 'attack_vector': 'Network',
 'description': 'A severe vulnerability in Cisco Unified Communications '
                'Manager (Unified CM) systems could allow remote attackers to '
                'gain root-level access to affected devices. The '
                'vulnerability, designated CVE-2025-20309 with a maximum CVSS '
                'score of 10.0, affects Engineering Special releases and stems '
                'from hardcoded SSH credentials that cannot be modified or '
                'removed by administrators.',
 'impact': {'systems_affected': ['Cisco Unified Communications Manager',
                                 'Cisco Unified Communications Manager Session '
                                 'Management Edition']},
 'initial_access_broker': {'entry_point': 'Hardcoded SSH credentials'},
 'lessons_learned': 'Immediate patching or system updates are the only '
                    'effective mitigation strategy for critical '
                    'vulnerabilities.',
 'motivation': 'Unauthorized access and control',
 'post_incident_analysis': {'corrective_actions': ['Apply patch '
                                                   'ciscocm.CSCwp27755_D0247-1.cop.sha512',
                                                   'Upgrade to 15SU3 release'],
                            'root_causes': 'Hardcoded SSH credentials left in '
                                           'the system during development '
                                           'phases'},
 'recommendations': 'Organizations should prioritize updating affected systems '
                    'immediately.',
 'response': {'containment_measures': ['Apply patch '
                                       'ciscocm.CSCwp27755_D0247-1.cop.sha512',
                                       'Upgrade to 15SU3 release'],
              'enhanced_monitoring': 'Monitor system logs for unauthorized '
                                     'root access',
              'remediation_measures': ['Monitor system logs for unauthorized '
                                       'root access',
                                       'Examine /var/log/active/syslog/secure '
                                       'file for indicators of compromise']},
 'title': 'CVE-2025-20309: Critical Root Access Vulnerability in Cisco Unified '
          'Communications Manager',
 'type': 'Remote Access Vulnerability',
 'vulnerability_exploited': 'CVE-2025-20309'}