CVE-2025-20309CWE-798

Cisco Unified Communications Manager Static SSH Credentials Vulnerability

Critical · published July 2, 2025

CVSS v3.1
10.0
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

🚨 A remote attacker could waltz right in using default root credentials on Cisco's Unified Communications Manager! 🔥 This is like leaving your front door wide open with a welcome mat that says "Come on in, the keys are on the kitchen counter!" It's an invitation for mischief, with the root account just waiting for someone to take advantage. An attacker could log into the system with full root access, allowing them to execute arbitrary commands and potentially wreak havoc on your communications infrastructure. The implications are absolutely devastating, as they could disrupt services, steal sensitive information, or worse – take full control of the system!

Put simply

This is like leaving your front door wide open with a welcome mat that says "Come on in, the keys are on the kitchen counter!" It's an invitation for mischief, with the root account just waiting for someone to take advantage. This critical vulnerability arises from the existence of static user credentials for the root account, which cannot be changed or deleted, allowing unauthenticated remote access to an affected device.

What to do

An attacker could log into the system with full root access, allowing them to execute arbitrary commands and potentially wreak havoc on your communications infrastructure. The implications are absolutely devastating, as they could disrupt services, steal sensitive information, or worse – take full control of the system! Immediately patch your Cisco Unified Communications Manager to the latest version to close this vulnerability. Review your security policies surrounding default credentials, and ensure strong authentication measures are in place. Regularly audit your systems for any unauthorized access as a precaution! You've got this! Secure your systems and emerge as the hero in this cybersecurity saga! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01185 · 67.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2025-07-02T16:39Z
EPSS history
Timeline
  • 02 JUL 16:39Z
    Cisco Unified Communications Manager Static SSH Credentials Vulnerability
    cvelistv5