Cisco Unified CM Vulnerability Lets Remote Attacker Gain Root Access

A newly disclosed, critical vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) has exposed organizations to the risk of full system compromise.

Tracked as CVE-2025-20309 and assigned a maximum CVSS score of 10.0, the flaw allows unauthenticated remote attackers to gain root access using static, hardcoded SSH credentials that were inadvertently left in production releases.

Vulnerability Details

The issue stems from static user credentials for the root account—credentials reserved for development and never meant to be shipped with production builds.

These credentials cannot be changed or deleted by administrators, making affected systems especially vulnerable.

An attacker exploiting this flaw can log in remotely over SSH as the root user, granting them the ability to execute ...