Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7)

Publisher

Cisco PSIRT

URL

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7

Published

2025-07-02

Updated

unknown

Accessed

2026-09-25

HTTP status

200

License

Cisco copyright; all rights reserved; no-redistribution; short excerpts and locators only

Source notes citing this source

• No workaround exists for CVE-2025-20309. The fix is Release 15SU3 (July 2025) or the COP patch file ciscocm.CSCwp27755_D0247-1.cop.sha512. in context
• The advisory's indicator of compromise for CVE-2025-20309 is a successful root SSH login recorded in /var/log/active/syslog/secure. in context
• CVE-2025-20309 (cisco-sa-cucm-ssh-m4UBdpE7) is a static root SSH credential in Unified CM and Unified CM SME Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1. It applies regardless of device configuration and has a CVSS 3.1 base score of 10.0. in context

Cite this source record

APA

WarmTransfer. (2025, July 2). Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7). WarmTransfer. https://warmtransfer.net/knowledge/sources/cisco-psirt-cucm-ssh-m4ubdpe7

BibTeX

@misc{warmtransfer-cisco-psirt-cucm-ssh-m4ubdpe7,
  title  = {Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7)},
  author = {{WarmTransfer}},
  year   = {2025},
  url    = {https://warmtransfer.net/knowledge/sources/cisco-psirt-cucm-ssh-m4ubdpe7},
  note   = {Cisco PSIRT, accessed 2026-09-25}
}