CVE-2025-20309

This flaw lets an attacker break into your Cisco phone/communications server over the network and log in as the highest-privilege administrator (root) using default credentials. Once inside as root, the attacker can run commands to take control, disrupt services, or set up further damage—similar to finding a “master key” that’s hard-coded into the building’s main door.

This matters if your business uses Cisco Unified Communications Manager or Cisco Unified Communications Manager SME to run your voice/communications services. The finding says default root credentials may be enabled on vulnerable versions, and exploitation has been reported.

It is a risk when your vulnerable device is reachable over the network for SSH/remote access (especially if accessible from the internet), and attackers can reach the service without needing a login.

RED — attackers are already exploiting this vulnerability in the real world. The flaw provides remote, unauthenticated root-level access, which means a compromise can be immediate and total.

Because the advisory notes default/static root credentials and exploitation activity has been confirmed, you should act now to block exposure and schedule the fixed upgrade.