Cisco warns of a serious security flaw in comms platform – and that it needs patching immediately – 1v1 Video Chat & LIve Streaming & Influencer Subscription

By Sead Fadilpašić

Tech Radar Pro

Tech Radar Gaming

Tech Radar Pro

TechRadar the business technology experts

Search TechRadar

View Profile

België (Nederlands)

Deutschland

North America

US (English)

Australasia

New Zealand

Expert Insights

Website builders

Web hosting

Best website builder
Best web hosting
Best office chairs
Best antivirus
Expert Insights

Recommended reading

Cisco warns over worrying security flaws in ISE affecting AWS, Azure cloud deployments – here’s what you need to know

Cisco Webex security flaw could let hackers hijack your system via a meeting invite

Cisco has patched a worrying flaw which could have let attackers hijack devices

Commvault backup systems have an extremely worrying security issue, so patch now

One of the world’s most popular CMS tools has an embarrassing security flaw, so patch immediately

This critical FortiSwitch flaw allows hackers to change admins passwords, and they can even do it remotely

HPE flags critical StoreOnce auth bypass, users should update now

Cisco warns of a serious security flaw in comms platform – and that it needs patching immediately

Sead Fadilpašić

3 July 2025

Researchers found hardcoded credentials in Cisco Unified Communications Manager

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Image Credit: Pixabay
(Image credit: Image Credit: Geralt / Pixabay)

Login credentials for an account with root access was found in Cisco’s Unified Communications Manager
There are no workarounds, just a patch, so users should update now
Different versions of the tool are affected

Another hardcoded credential for admin access has been discovered in a major software application – this time around it’s Cisco, who discovered the slip-up in its Unified Communications Manager (Unified CM) solution.

Cisco Unified CM is an enterprise-grade IP telephony call control platform providing voice, video, messaging, mobility, and presence services. It manages voice-over-IP (VoIP) calls, and allows for the management of tasks such as user/device provisioning, voicemail integration, conferencing, and more.
Recently, Cisco found login credentials coded into the program, allowing for access with root privileges. The bug is now tracked as CVE-2025-20309, and was given a maximum severity score – 10/10 (critical). The credentials were apparently used during development and testing, and should have been removed before the product was shipped to the market.

You may like

Cisco warns over worrying security flaws in ISE affecting AWS, Azure cloud deployments – here’s what you need to know

Cisco Webex security flaw could let hackers hijack your system via a meeting invite

Cisco has patched a worrying flaw which could have let attackers hijack devices

Get 55% off Incogni’s Data Removal service with code TECHRADAR
Wipe your personal data off the internet with the Incogni data removal service. Stop identity thieves
and protect your privacy from unwanted spam and scam calls.

No evidence of abuse
Cisco Unified CM and Unified CM SME Engineering Special (ES) releases 15.0.1.13010-1 through 15.0.1.13017-1 were said to be affected, regardless of the device configuration. There are no workarounds or mitigations, and the only way to address it is to upgrade the program to version 15SU3 (July 2025).

“A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted,” Cisco said.
At press time, there was no evidence of abuse in the wild.
Hardcoded credentials are one of the more common causes of system infiltrations. Just recently Sitecore Experience Platform, an enterprise-level content management system (CMS), held a hardcoded password for an internal user. It was just one letter – ‘b’ – which was super easy to guess.

Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.
Roughly a year ago, security researchers from Horizon3.ai found hardcoded credentials in SolarWinds’ Web Help Desk.
Via BleepingComputer
You might also like

New Chrome flaw leaks sensitive information across websites – your data could already be in the wrong hands
Take a look at our guide to the best authenticator app
We’ve rounded up the best password managers

Sead Fadilpašić

Social Links Navigation

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Cisco warns over worrying security flaws in ISE affecting AWS, Azure cloud deployments – here’s what you need to know

Cisco Webex security flaw could let hackers hijack your system via a meeting invite

Cisco has patched a worrying flaw which could have let attackers hijack devices

Commvault backup systems have an extremely worrying security issue, so patch now

One of the world’s most popular CMS tools has an embarrassing security flaw, so patch immediately

This critical FortiSwitch flaw allows hackers to change admins passwords, and they can even do it remotely

Latest in Security

Google has patched another urgent security flaw in Chrome – so update now or be at risk

Security experts flag another worrying issue with Anthropic AI systems – here’s what they found

Insurance group Kelly Benefits says over half a million people now affected in major data breach – here’s what we know

AT&T has a new tool to stop dangerous SIM swapping attacks – here’s how it will keep you safe

Qantas reveals massive data breach – 6 million customers possibly affected, here’s what we know

Major new Microsoft Defender update will now block one of the most dangerous kinds of cyberattack

Latest in News

ChatGPT faceplants while translating Crunchyroll anime, and some viewers are demanding human localization

How to watch Samsung Galaxy Unpacked on July 9: get ready for new foldable phones and more

Want a first look at Christopher Nolan’s The Odyssey? There’s currently only one place to see the trailer

NordVPN blocks 90% of phishing sites and earns AV-Comparatives certification – again

Hurry! It’s your last chance to claim in Apple’s $95 million Siri settlement – here’s how to do it

Confused by a mysterious update that’s suddenly appeared on your Windows 10 PC? Don’t panic – here’s what you need to know