0xreadingsteiner/silent-callSilent;Call — Pre-authentication remote root on Cisco CUCM 15.x (CVSS 10.0)
Pre-authentication remote root on Cisco Unified Communications Manager 15.x
Three HTTP requests. Zero credentials. Root access. Every call is now yours.
| Step | Component | Description |
|---|---|---|
| 1 | Spoofhack | X-Forwarded-For header spoofing bypasses localhost restriction on Tomcat Manager |
| 2 | Keyhack | Hardcoded credentials (identical on every CUCM installation) grant WAR deployment |
| 3 | Roothack | Passwordless sudo to gdb with attacker-controlled command file → root |
Root access to CUCM grants an attacker the ability to intercept all voice communications, access SRTP encryption keys, activate built-in lawful intercept (CALEA) wiretapping, access all voicemail, manipulate call routing, disable E911 emergency services, and exfiltrate complete call detail records.
| File | Description |
|---|---|
| ADVISORY.md | Full technical advisory with root cause analysis |
| poc.sh | Proof of concept script (bash/curl) |
# Test if a CUCM instance is vulnerable (read-only, no exploitation)
curl -sk -H "X-Forwarded-For: 127.0.0.1" \
-u '1mJdd4WKi+:1ge1AVWsx~' \
"https://TARGET:443/manager/text/list"
If you see OK - Listed applications for virtual host [localhost] — the system is vulnerable.
Full coordination timeline: cisco-security-research
0xReadingSteiner — [email protected]
This research was conducted independently on commercially available software in a private laboratory. No proprietary source code, internal tools, or confidential information was used.
Advisory text: CC BY 4.0. PoC script: defensive and educational purposes only.