📄 Cisco CUCM 15.x Remote Code Execution

## Advisory Information
    
    - Advisory IDs: SKYLINE-2026-001, SKYLINE-2026-002, SKYLINE-2026-003
    - Title: Pre-Authentication Remote Root via Tomcat Manager Header Injection + Hardcoded Credentials
    - CVSSv3.1: 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    - CWE: CWE-798, CWE-644, CWE-269
    - Product: Cisco Unified Communications Manager 15.0.1.12900-234
    - Vendor: Cisco Systems, Inc.
    - Public Disclosure: 2026-08-04
    - Researcher: 0xReadingSteiner ([email protected])
    
    ## Summary
    
    A pre-authentication remote code execution chain in Cisco CUCM 15.x
    allows an unauthenticated network attacker to achieve root-level access
    in three HTTP requests.
    
    The chain exploits:
    
    1. RemoteIpValve misconfiguration — accepts X-Forwarded-For from any
    source without internalProxies restriction, allowing IP spoofing
    as 127.0.0.1
    
    2. Hardcoded Tomcat Manager credentials — identical on every CUCM 15.x
    installation (username: 1mJdd4WKi+ / password: 1ge1AVWsx~), not
    configurable by administrators
    
    3. Unrestricted sudo for the tomcat user — passwordless gdb with an
    attacker-controlled command file in /tmp, plus three additional
    independent root escalation paths (systemctl, PYTHONPATH, LD_PRELOAD)
    
    ## Impact
    
    Root access to CUCM grants: interception of all voice communications
    via SRTP key extraction, silent activation of built-in CALEA-compliant
    lawful intercept wiretapping, access to all voicemail, complete CDR
    exfiltration, call routing manipulation, E911 disruption, and lateral
    movement into the voice VLAN.
    
    CUCM is deployed in Fortune 500 companies, US federal agencies, the
    Department of Defense, hospitals, financial institutions, law
    enforcement, and telecommunications providers worldwide.
    
    ## Quick Test
    
    curl -sk -H "X-Forwarded-For: 127.0.0.1" \
    -u '1mJdd4WKi+:1ge1AVWsx~' \
    "https://TARGET:443/manager/text/list"
    
    If the response begins with "OK - Listed applications for virtual
    host [localhost]" — the system is vulnerable.
    
    ## Vendor Coordination
    
    - 17 CUCM submissions to ZDI — unprocessed
    - SSD paused CUCM acquisitions (Cisco won't fix existing reports)
    - Cisco PSIRT contacted 2026-08-04 — no response
    - MITRE CVE IDs requested (CNA of Last Resort) — pending
    
    This is advisory 1 of 55 identified vulnerabilities in CUCM 15.x.
    
    ## References
    
    Full advisory: https://github.com/0xReadingSteiner/Silent-Call
    PoC script: https://github.com/0xReadingSteiner/Silent-Call/blob/main/poc.sh
    Master index: https://github.com/0xReadingSteiner/cisco-security-research
    
    ## Disclosure Statement
    
    This research was conducted independently on commercially available
    software in a private laboratory. No proprietary source code, internal
    tools, or confidential information was used. Coordination was attempted
    through three independent channels before publication.
    
    Additional findings will be published on a rolling basis.
    
    0xReadingSteiner
    [email protected]: D5E22255F645A8B935056C278C0958C5D533080A
    
    Sent with [Proton Mail](https://proton.me/mail/home) secure email.