Cisco warns that Unified CM has hardcoded root SSH credentials

Source: BleepingComputer

Author: Sergiu Gatlan

URL: https://www.bleepingcomputer.com/news/security/cisco-removes-unified-cm-callManager-backdoor-root-account/

ONE SENTENCE SUMMARY:

Cisco has patched a critical backdoor vulnerability (CVE-2025-20309) in Unified Communications Manager allowing attackers remote root access.

MAIN POINTS:

  1. Cisco Unified CM had a critical backdoor root account vulnerability identified as CVE-2025-20309.
  2. The vulnerability arises from static, default credentials used during development and testing.
  3. CVE-2025-20309 affects Unified CM and SME Engineering Special releases 15.0.1.13010-1 to 15.0.1.13017-1.
  4. Exploitation allows unauthenticated attackers root-level remote access to affected systems.
  5. No workarounds exist; admins must upgrade or apply the CSCwp27755 security patch.
  6. Cisco provided indicators of compromise to assist detection and response efforts.
  7. Successful exploitation creates log entries under /var/log/active/syslog/secure accessible by admins.
  8. Cisco previously experienced similar backdoor vulnerabilities in IOS XE, DNA Center, and Emergency Responder.
  9. Earlier this year, Cisco patched similar issues in Smart Licensing Utility and IOS XE devices.
  10. No current evidence indicates active exploitation or available proof-of-concept code online.

TAKEAWAYS:

  1. Immediately apply the Cisco-provided security patch or upgrade to mitigate this severe vulnerability.
  2. Regularly check logs at /var/log/active/syslog/secure for suspicious root user activities.
  3. Stay vigilant for security advisories from Cisco regarding hardcoded credential vulnerabilities.
  4. Maintain awareness that even reputable products may have hidden backdoor accounts.
  5. Prioritize patch management to rapidly address high-severity vulnerabilities in critical infrastructure.