Cisco Patches CVSS 10.0 Unified Communications Manager Flaw That Could Grant Root Access
Summary
Cisco patched CVE-2025-20309, a CVSS 10.0 hard-coded-credential flaw affecting specified Unified CM versions. CloudSEK found over 1,000 internet-exposed assets; Cisco reported no public exploitation.
Key points
- The flaw affects Unified CM and Unified CM Session Management Edition versions 15.0.1.13010-1 through 15.0.1.13017-1 and can grant root access regardless of device configuration.
- CloudSEK reported more than 1,000 internet-exposed assets running Unified CM, based on FOFA search results.
- Cisco said there had been no public exploitation at the time covered by the article; CloudSEK assessed that capable actors may try to develop an exploit.
- Potential consequences include full system compromise, lateral movement, data theft, ransomware, and interception or disruption of VoIP traffic.
- Cisco security updates are available; recommended steps include patching, restricting management access, monitoring for unexpected successful root SSH logins, and segmenting networks.
Article Details
- Vulnerability Types
- Hard-coded credentials
- Severity
- CVSS 10.0
- Affected Versions
- Unified CM and Unified CM SME 15.0.1.13010-1 through 15.0.1.13017-1
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- Restrict access to Unified CM management interfaces using firewall rules and VPNs.
- Segment vulnerable or critical VoIP infrastructure from general network segments.
MITRE ATT&CK
CVE
CVE-2025-20281This comes after Cisco patched two security vulnerabilities (CVE-2025-20281 and CVE-2025-20282) within its Identity Services Engine and ISE Passive Identity Connector, which previously allowed unauthenticated attackersCVE-2025-20282This comes after Cisco patched two security vulnerabilities (CVE-2025-20281 and CVE-2025-20282) within its Identity Services Engine and ISE Passive Identity Connector, which previously allowed unauthenticated attackersCVE-2025-20309Cisco has released urgent security updates to fix a critical vulnerability (CVE-2025-20309, CVSS 10.0) in Unified Communications Manager (Unified CM) and its Session Management Edition. This flaw allows attackers to
Threat Actors
APT28CloudSEK identifies APT28 as a potential actor that may seek to weaponize the vulnerability; the article also names Fancy Bear as an alias.Fancy BearNamed in the article as an alias of APT28, which it identifies as a potential actor that may seek to weaponize the vulnerability.MuddyWaterCloudSEK identifies MuddyWater as a potential actor that may seek to weaponize the vulnerability.SPIRE CASTLECloudSEK identifies APT41 as a potential actor that may seek to weaponize the vulnerability.
Vendors
Products
Identity Services Engineafter Cisco patched two security vulnerabilities (CVE-2025-20281 and CVE-2025-20282) within its Identity Services Engine and ISE Passive Identity Connector, which previously allowed unauthenticated attackers toISE Passive Identity Connectorvulnerabilities (CVE-2025-20281 and CVE-2025-20282) within its Identity Services Engine and ISE Passive Identity Connector, which previously allowed unauthenticated attackers to execute arbitrary commands with rootUnified CM Session Management Editionvulnerability (CVE-2025-20309) in its Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). This flaw, with a CVSS score of 10.0, allows an attacker to gain rootUnified Communications Managerurgent security updates to fix a critical vulnerability (CVE-2025-20309, CVSS 10.0) in Unified Communications Manager (Unified CM) and its Session Management Edition. This flaw allows attackers to gain root
Tools
Countries
China2. APT41 (China):CzechiaThe majority of the assets are in the United States, followed by Thailand, Korea, Russia, Czechia, Japan, Mali and Lithuania. Iran3. MuddyWater (Iran):IsraelTargeted telco and government infrastructure in UAE, Turkey, and Israel.JapanThe majority of the assets are in the United States, followed by Thailand, Korea, Russia, Czechia, Japan, Mali and Lithuania. Koreaof device configuration. Over a thousand exposed devices exist worldwide, primarily in the US, Thailand, Korea, Russia, and Europe; some of them pertaining to organizations in highly critical sectors. Notable threatLithuaniaThe majority of the assets are in the United States, followed by Thailand, Korea, Russia, Czechia, Japan, Mali and Lithuania. MaliThe majority of the assets are in the United States, followed by Thailand, Korea, Russia, Czechia, Japan, Mali and Lithuania. Russiaconfiguration. Over a thousand exposed devices exist worldwide, primarily in the US, Thailand, Korea, Russia, and Europe; some of them pertaining to organizations in highly critical sectors. Notable threat actorsThailandof device configuration. Over a thousand exposed devices exist worldwide, primarily in the US, Thailand, Korea, Russia, and Europe; some of them pertaining to organizations in highly critical sectors. NotableTurkeyTargeted telco and government infrastructure in UAE, Turkey, and Israel.United Arab EmiratesUnited StatesThe majority of the assets are in the United States, followed by Thailand, Korea, Russia, Czechia, Japan, Mali and Lithuania.