CVE-2025-20309criticalCWE-798

CVE-2025-20309: falha crítica em Cisco Unified Communications Manager

Cisco Unified Communications Manager Static SSH Credentials Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Cisco Unified Communications Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 1.2%
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Cisco · Cisco Unified Communications Manager
CVEs relacionadas — Cisco Unified Communications Manager

No mesmo produto, das mais perigosas para as menos.

CVE-2026-20230HIGHCisco Unified Communications Manager Server-Side Request Forgery VulnerabilityEPSS 88.5%KEVCVE-2026-20045HIGHCisco Unified Communications Products Remote Code Execution VulnerabilityEPSS 4.5%KEVCVE-2020-3177HIGHCisco Unified Communications Manager Path Traversal VulnerabilityEPSS 2.8%CVE-2019-1837MEDIUMCisco Unified Communications Manager Denial of Service VulnerabilityEPSS 2.4%CVE-2024-20253CRITICALCVE-2024-20253EPSS 2.4%CVE-2022-20790MEDIUMCisco Unified Communications Products Arbitrary File Read VulnerabilityEPSS 1.9%