Unified CM security hardening

See also

Sources

1. 1
   Audit logging is configured in Cisco Unified Serviceability under Tools > Audit Log Configuration. Changing it requires the Audit role, which the CCMAdministrator account holds by default.

   Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs · Audit Logs > Configure Audit Logging · Checked 2026-09-25
2. 2
   Application audit logging is on by default. Database audit logging and system (auditd) audit logging are off by default, and auditd is enabled from the CLI with utils auditd.

   Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs · Audit Logs > Audit Logging (application / database / OS) · Checked 2026-09-25
3. 3
   Unified CM has three audit logs: the Linux auditd log, the Unified CM application audit log and the Informix database audit log.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Operating System and Security Hardening · Operating System and Security Hardening > Audit Logging · Checked 2026-09-25
4. 4
   Create a new system backup every time the TFTP certificate is regenerated.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates · Certificates > Regenerate Certificates > backup note · Checked 2026-09-25
5. 5
   After regenerating the CallManager certificate, restart the Cisco CallManager, Cisco CTIManager and HAProxy services, and update the CTL file if the cluster is in mixed mode.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates · Certificates > Certificate names and descriptions / restart table · Checked 2026-09-25
6. 6
   CAPF certificate operations can authenticate the phone by authentication string, by null string (no user action, low security) or by existing certificate (LSC or MIC precedence).

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security > CAPF authentication mode · Checked 2026-09-25
7. 7
   Common Criteria mode (utils fips_common_criteria enable) needs FIPS mode enabled first and does not work with TLS 1.3.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Common Criteria Mode · Checked 2026-09-25
8. 8
   The Cisco Certificate Expiry Monitor service checks certificates every 24 hours by default. It checks hourly once a certificate has expired or will expire within a day.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates · Certificates > Certificate Monitoring · Checked 2026-09-25
9. 9
   In Cipher Management, changing All TLS or the SSH cipher, key exchange or MAC fields requires rebooting all cluster nodes. HTTPS TLS needs a Cisco Tomcat restart and SIP TLS needs a Unified CM restart.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cipher Management · Cipher Management > Cipher field restrictions / actions table · Checked 2026-09-25
10. 10
    The Cipher Management page warns that configuring hmac-sha2-512 as SSH MAC, or restricting to GCM ciphers or a single key-exchange algorithm, can break DRS and CDR functionality.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cipher Management · Cipher Management > SSH field cautions · Checked 2026-09-25
11. 11
    An empty Cipher Management field means the default ciphers apply. Certain weak ciphers are never allowed, even if configured.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cipher Management · Cipher Management > overview notes · Checked 2026-09-25
12. 12
    Unified CM is a closed, turnkey appliance. Native OS interfaces are restricted, and access is only through the Cisco-provided GUI, CLI or API.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Operating System and Security Hardening · Operating System and Security Hardening > overview · Checked 2026-09-25
13. 13
    Credential policies do not apply to operating system or CLI users, which follow the operating system's own password verification.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Credential Policies · Credential Policies > overview note · Checked 2026-09-25
14. 14
    Credential policies apply to end-user PINs, application-user passwords and end-user passwords. When LDAP authentication is enabled, they no longer apply to end-user passwords.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Credential Policies · Credential Policies > overview · Checked 2026-09-25
15. 15
    In mixed mode only, you must update the CTL file after regenerating the CallManager, CAPF or ITLRecovery certificate.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates · Certificates > Regenerate Certificates > CTL update note · Checked 2026-09-25
16. 16
    utils ctl update CTLFile regenerates the CTL file and updates it across the cluster nodes.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Update the CTL File · Checked 2026-09-25
17. 17
    No workaround exists for CVE-2025-20309. The fix is Release 15SU3 (July 2025) or the COP patch file ciscocm.CSCwp27755_D0247-1.cop.sha512.

    Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7) · Advisory > Workarounds; Fixed Software · Checked 2026-09-25
18. 18
    The advisory's indicator of compromise for CVE-2025-20309 is a successful root SSH login recorded in /var/log/active/syslog/secure.

    Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7) · Advisory > Indicators of Compromise · Checked 2026-09-25
19. 19
    CVE-2025-20309 (cisco-sa-cucm-ssh-m4UBdpE7) is a static root SSH credential in Unified CM and Unified CM SME Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1. It applies regardless of device configuration and has a CVSS 3.1 base score of 10.0.

    Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7) · Advisory > Summary; Affected Products · Checked 2026-09-25
20. 20
    Cisco warns that database audit logging can generate large amounts of data quickly and can significantly affect performance during heavy use.

    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs · Audit Logs > Database Audit Logs caution · Checked 2026-09-25
21. 21
    Under Enhanced Security Mode, contact search authentication is enabled by default, and the default remote audit logging transport changes to TCP unless TLS is already configured.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Enhanced Security Mode · Checked 2026-09-25
22. 22
    Enhanced Security Mode (utils EnhancedSecurityMode enable) runs on FIPS-enabled systems. It requires passwords of 14 to 127 characters with lowercase, uppercase, digit and special characters, blocks reuse of the last 24 passwords, and sets a 60-day maximum age.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Enhanced Security Mode · Checked 2026-09-25
23. 23
    Enabling FIPS mode regenerates certificates and the SSH key automatically, so third-party CA-signed certificates must be uploaded again afterwards.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Enable FIPS 140-2 Mode · Checked 2026-09-25
24. 24
    The Security Guide advises disabling FIPS mode before upgrading to a version that is not FIPS-compliant.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > cautions · Checked 2026-09-25
25. 25
    utils fips enable reboots the node, runs certification self-tests at startup, checks cryptographic module integrity and regenerates keying material.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Enable FIPS 140-2 Mode · Checked 2026-09-25
26. 26
    The Release 15 Security Guide describes Unified CM FIPS mode as FIPS 140-2 mode, and its New and Changed Information page does not mention FIPS 140-3.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Enable FIPS 140-2 Mode (heading) · Checked 2026-09-25
27. 27
    FIPS mode requires a security password of at least 14 characters, and every node in the cluster must be in the same mode, all FIPS or all non-FIPS.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Enable FIPS 140-2 Mode > Before you begin · Checked 2026-09-25
28. 28
    Because the Release 15 guide labels Unified CM FIPS mode as FIPS 140-2 and NIST moved all 140-2 certificates to the Historical List on 22 September 2026, an organisation with a FIPS 140-3 procurement requirement cannot assume Unified CM FIPS mode meets it without checking Cisco's current CMVP certificate status.inferred

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Enable FIPS 140-2 Mode (heading), combined with NIST timeline · Checked 2026-09-25
29. 29
    In FIPS mode, MD5 and DES do not work. SNMPv3 must use SHA authentication with AES128 privacy, and Certificate Remote Enrolment is not supported.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > FIPS mode restrictions · Checked 2026-09-25
30. 30
    If any FIPS self-test fails, the Unified CM server halts.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > caution · Checked 2026-09-25
31. 31
    In a cluster, enable FIPS on the publisher first and wait for phones to re-register before enabling it on other nodes. Do not run security mode commands on all nodes at once.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup · FIPS Mode Setup > Enable FIPS 140-2 Mode > procedure notes · Checked 2026-09-25
32. 32
    The ITLRecovery certificate is self-signed only and cannot be CA-signed.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates · Certificates > Certificate types > ITLRecovery · Checked 2026-09-25
33. 33
    Because Unified CM credential policies do not cover CLI/OS users or LDAP-authenticated end-user passwords, lockout and complexity for those accounts must be enforced elsewhere: at the directory for LDAP users and by the platform OS rules for CLI users.inferred

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Credential Policies · Credential Policies > overview (derived) · Checked 2026-09-25
34. 34
    Before moving a cluster from non-secure mode to mixed mode, the Certificate Authority Proxy Function (CAPF) service and the Certificate Trust List (CTL) service must be enabled on the publisher.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Mixed Mode · Checked 2026-09-25
35. 35
    To enable mixed mode, run utils ctl set-cluster mixed-mode from the CLI on the publisher node.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Configure Mixed Mode through CLI (utils ctl set-cluster mixed-mode) · Checked 2026-09-25
36. 36
    Mixed mode lets a Unified CM cluster serve secure and non-secure endpoints together, using TLS for signaling and SRTP for media on secure endpoints.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Mixed Mode · Checked 2026-09-25
37. 37
    Mixed mode requires Unified CM to be registered with Cisco Smart Software Manager or a satellite, using a registration token with Allow Export-Controlled functionality enabled.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Mixed Mode > prerequisites · Checked 2026-09-25
38. 38
    Unified CM does not support certificates with wildcard entries such as *.example.com.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates · Certificates > restrictions (wildcard entry) · Checked 2026-09-25
39. 39
    A Unified CM cluster is installed in non-secure mode by default, and in that mode it provides no secure signaling or media services.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Non-Secure Mode (Default Mode) · Checked 2026-09-25
40. 40
    utils ctl set-cluster non-secure-mode returns a mixed-mode cluster to non-secure mode.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > CLI commands for CTL (utils ctl set-cluster non-secure-mode) · Checked 2026-09-25
41. 41
    The enterprise parameter Effective Access Privileges For Overlapping User Groups and Roles defaults to Maximum, meaning a user in several access control groups gets the highest privileges among them. It can be set to Minimum.

    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage User Access · Manage User Access > Configure Overlapping Privilege Policy for Access Control Groups · Checked 2026-09-25
42. 42
    The Phone Security chapter lists optional phone hardening settings: Gratuitous ARP disable, Web Access disable, PC Port disable, Settings Access disable and PC Voice VLAN Access disable.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security > Phone Hardening · Checked 2026-09-25
43. 43
    The Authenticated and Encrypted phone device security modes require the cluster to be in mixed mode.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security > prerequisites · Checked 2026-09-25
44. 44
    Phone security profiles offer three device security modes: Non Secure (TCP), Authenticated (TLS with NULL/SHA) and Encrypted (TLS with AES signaling, plus SRTP media on encrypted calls).

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security > Phone Security Profile > Device Security Mode · Checked 2026-09-25
45. 45
    If you regenerate several certificates, regenerate the TFTP certificate last.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates · Certificates > Regenerate Certificates · Checked 2026-09-25
46. 46
    The Audit Logs chapter says the remote syslog server and IPsec between each cluster node and that server must be set up before remote audit logging is configured.

    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs · Audit Logs > Set Up Remote Audit Logging > Before you begin · Checked 2026-09-25
47. 47
    Remote audit logging to syslog uses UDP by default in normal mode and can be changed to TCP or TLS. TLS supports unidirectional or bidirectional X.509 authentication.

    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs · Audit Logs > Audit Log Configuration Settings > Transport Protocol · Checked 2026-09-25
48. 48
    Unified CM roles grant each resource one of three permission levels: Read, Update or No Access.

    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage User Access · Manage User Access > Roles · Checked 2026-09-25
49. 49
    SELinux enforcing mode and the IPTables host firewall are both enabled by default on Unified CM. Firewall rules can be listed with utils firewall ipv4 list and utils firewall ipv6 list.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Operating System and Security Hardening · Operating System and Security Hardening > SELinux / IPTables · Checked 2026-09-25
50. 50
    For standard roles and their associated standard access control groups, the privileges and role assignments cannot be edited. Custom roles are needed for least-privilege administration and can be created from scratch or by copying an existing role.

    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage User Access · Manage User Access > Standard Roles and Access Control Groups; Create a Custom Role · Checked 2026-09-25
51. 51
    On a fresh install the minimum TLS version is 1.2, with TLS 1.0 and 1.1 disabled. An upgrade or migration keeps the minimum TLS version from the previous release.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - TLS 1.3 Setup (From Release 15SU2 Onwards) · TLS 1.3 Setup > Supported TLS versions (fresh install vs upgrade) · Checked 2026-09-25
52. 52
    A minimum TLS version change made on the publisher replicates to the other cluster nodes. IM and Presence must be configured separately, and all nodes must be restarted for the change to take effect.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - TLS 1.3 Setup (From Release 15SU2 Onwards) · TLS 1.3 Setup > Set Minimum TLS Version > notes · Checked 2026-09-25
53. 53
    The minimum TLS version is set with set tls min-version (for example, set tls min-version 1.3) and checked with show tls min-version.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - TLS 1.3 Setup (From Release 15SU2 Onwards) · TLS 1.3 Setup > Set Minimum TLS Version · Checked 2026-09-25
54. 54
    Unified CM supports TLS 1.3 from Release 15SU2 onwards.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - TLS 1.3 Setup (From Release 15SU2 Onwards) · TLS 1.3 Setup (From Release 15SU2 Onwards) > chapter title and overview · Checked 2026-09-25
55. 55
    If SRTP is allowed on a SIP trunk that uses a non-secure trunk security profile, SRTP still works but the keys are exposed in signaling and traces.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > SRTP Allowed warning · Checked 2026-09-25
56. 56
    A SIP trunk security profile using TLS authenticates the peer against its Secure Certificate Subject or Subject Alternate Name field. The default TLS port is 5061.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > SIP Trunk Security Profile settings · Checked 2026-09-25
57. 57
    The Trust Verification Service (TVS) runs on Unified CM servers and authenticates certificates on behalf of Cisco IP phones, so phones do not need to store every trusted certificate locally.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security > Trust Verification Service · Checked 2026-09-25
58. 58
    Access control groups carry a user rank from 1 to 10, with 1 the highest and the default. A user can only be added to groups whose minimum rank the user meets.

    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage User Access · Manage User Access > User Rank Hierarchy · Checked 2026-09-25

Documents

Cite this page

WarmTransfer. (2026, September 25). Unified CM security hardening. WarmTransfer. https://warmtransfer.net/knowledge/cucm-security-hardening

@misc{warmtransfer-cucm-security-hardening,
  title  = {Unified CM security hardening},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cucm-security-hardening},
  note   = {Verified 2026-09-25}
}