Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2025070408071818 | Publication Time | 2025/07/04 08:57 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2025/07/04 08:57 |
| Impact Level | Low | ||
| [Subject] [Vulnerability Alert] Critical Security Vulnerability in Cisco Unified Communications Manager (CVE-2025-20309) |
|||
| [Content] Forwarded from TWCERTCC-200-202507-00000003 Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) are unified communications platforms provided by Cisco, supporting voice, video, messaging, and collaboration functions. Recently, Cisco disclosed a critical security vulnerability (CVE-2025-20309, CVSS: 10.0). The vulnerability is due to a built-in default static credential associated with a root account that exists by default and cannot be modified or deleted by users. This could allow an unauthenticated remote attacker to log in with root privileges and execute arbitrary commands on affected systems. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] Cisco Unified Communications Manager versions 15.0.1.13010-1 to 15.0.1.13017-1 |
|||
| [Recommended Actions] Follow Cisco’s official remediation guidance: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7 |
|||
| [Reference] https://www.twcert.org.tw/tw/cp-169-10230-c2fec-1.html |
|||