Cisco Unified Communications Manager (CUCM) Static SSH Credentials (cisco-sa-cucm-ssh-m4UBdpE7)

#TRUSTED 922766839e731e54d1b82455eb27793308656dcb3d5a1a6f47a434c93cd4d7ef9003c0cdc2b26f9c14c0a16a12732ab1879fac0be7b83517d2edfe573ff6dbf88121f59ee14c3d669605c6865afb324812e013e939e8bfdd64e2b7737a01a7bb49306f487eaf373dd000126bb3d768ec82e7a01b5fff5dcf28d412a4b60ac579801858b86783042223edd8edd7d8f2da33985e35b35546617be8cb58d055a38ed05389975a0464c9fe564e6b5e1d422d6c06c68f51fff541ab1b98abfa9c4f8099370b6f8fe597f2d43c6fa8359cf29d1b9d0de28a8184c121907f4e5a701ec4ded65ef2adcbc2d7ed87b02425c24d653cefccef023c9d0da66adacd6d498ce1588b329f074896266fde6b099905463e8460b9f356deef1f37c79037e7502c6d93ead21009f99bbb206e84072358252ed8b6a899db3aa57b6b62bc1e0b6b769e07b495b1797ba06024210c7329f7102b1bc8479dbee3e81deaf8042e3266e80b20435453fbc0792073db88a8b324d723dd5bda3ebed9358b792cf94c151c0f0145f0d599ec2ddb9feaeb60a2e01592e2ae011a8d09c9d9b5e670d160327a7000671a879d662f4cc6a9978a579f7d6e40c213fa6b2c28b3f5ae8a41c57c7b6b813d47d553644d25573ba0931cefdc1254b48ab56aa039705de367dd17f626193d003e02509a88d9f5c7ba152b515f50d7ec8334496f6029c53d16a589639195a1
#TRUST-RSA-SHA256 89dd2cf0d7c14a9ef22fcb7a7749bd51bb11b904bf18ab8759e50677160140eb24ae2ea335f1576f6e25bfb4fa0ca9b9b97e3dda9c79c90e709262a7de93da69ac5167edaed23e888b8a2ebe46bd35087af0c86b5d87f757939c584f9304b47f704c503076169b6c923f77a34871a4c07bbf637ff30334e7d010217bdbe122db3f509fc0292b076d8d2926500a548db827efd516e41fefef1c63833eab14ddb27a0440f8040b6e66e9e1cd514afc79e0479502a5dd0e1fca81048857962b28925bf070d2ce740820e40c1b7eeb37a69c0a10ebf20a9281951e8044d055507f5b14beddd51f285b04c09c2ed4278272ff380252d571dc7fb9947aed448745b0eee5780bebdf34d55cac7a2e61187e860442f9f388ecf9fc3a61a03a5f32ca4258491bbb95291e8ca11968ed997041708b95e2d4b83ab66752515f8b23cadbc2325ed4d89d1a94aa8b31e8676f1e141c997187de0854e1942061b04e0723a0ae406bcd2f753cbb8fb9a49a1a4431d41fa507909cb847266616d4c33e51a77417c616c7f20249c267c8d1a9ccb9d2480cde990bd77ba475aebe89ccbda89032a1986305a3f812e4b4edbcf7e63851b2e11e1181e226cb6f401b90ae13fa00bec751b433157412d8012e6f26842663e4e68d8b225266344c1fff836960ff3ee7faaf826fbe60c86b5092482f91f9fc8bde4bd58478bfeb7b18900de474813eba5595
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(241369);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/04");

  script_cve_id("CVE-2025-20309");
  script_xref(name:"IAVA", value:"2025-A-0469");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwp27755");
  script_xref(name:"CISCO-SA", value:"cisco-sa-cucm-ssh-m4UBdpE7");

  script_name(english:"Cisco Unified Communications Manager (CUCM) Static SSH Credentials (cisco-sa-cucm-ssh-m4UBdpE7)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Unified Communications Products is affected by a hard-coded credentials
vulnerability.

  - A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications
  Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log
  in to an affected device using the root account, which has default, static credentials that cannot be
  changed or deleted. This vulnerability is due to the presence of static user credentials for the root
  account that are reserved for use during development. An attacker could exploit this vulnerability by using
  the account to log in to an affected system. A successful exploit could allow the attacker to log in to the
  affected system and execute arbitrary commands as the root user. (CVE-2025-20309)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?728c10a3");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp27755");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwp27755");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:M/C:N/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20309");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/04");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:unified_communications_manager");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ucm_detect.nbin");
  script_require_keys("Settings/ParanoidReport", "Host/Cisco/CUCM/Version");

  exit(0);
}

include('ccf.inc');

# there are 3 limiting factors making this paranoid:
# (1) only ES (Engineering Special) releases of UCM are affected and we can't determine this attribute of an install
# (2) the fix (15SU3) is not available at the time of writing
# (3) there is a patch available but we don't have the license to download it
if (report_paranoia < 2) audit(AUDIT_PARANOID);

var product_info = cisco::get_product_info(name:'Cisco Unified Communications Manager');

var fix = '15SU3';
var vuln_ranges = [
  # 15SU3 is not available yet; when it becomes available, it will likely be found at:
  # https://software.cisco.com/download/home/286331940/type/286319236/release/15SU3
  # Note: ccf's vuln_ranges does not support a "max_ver", so let's set the fix_ver to the advisory's max_ver + 1
  {'min_ver':'15.0.1.13010.1', 'fix_ver':'15.0.1.13017.2'}
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwp27755',
  'fix'           , fix,
  'disable_caveat', TRUE
);

cisco::check_and_report(product_info:product_info, reporting:reporting, vuln_ranges:vuln_ranges);