[FD] Silent;Call — Pre-Authentication Remote Root in Cisco CUCM 15.x (SKYLINE-2026-001/002/003)

[0xReadingSteiner via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

## Advisory Information

- Advisory IDs: SKYLINE-2026-001, SKYLINE-2026-002, SKYLINE-2026-003
- Title: Pre-Authentication Remote Root via Tomcat Manager Header Injection + 
Hardcoded Credentials
- CVSSv3.1: 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CWE: CWE-798, CWE-644, CWE-269
- Product: Cisco Unified Communications Manager 15.0.1.12900-234
- Vendor: Cisco Systems, Inc.
- Public Disclosure: 2026-08-04
- Researcher: 0xReadingSteiner (0xReadingSteiner@xxxxxxxxx)

## Summary

A pre-authentication remote code execution chain in Cisco CUCM 15.x
allows an unauthenticated network attacker to achieve root-level access
in three HTTP requests.

The chain exploits:

1. RemoteIpValve misconfiguration — accepts X-Forwarded-For from any
source without internalProxies restriction, allowing IP spoofing
as 127.0.0.1

2. Hardcoded Tomcat Manager credentials — identical on every CUCM 15.x
installation (username: 1mJdd4WKi+ / password: 1ge1AVWsx~), not
configurable by administrators

3. Unrestricted sudo for the tomcat user — passwordless gdb with an
attacker-controlled command file in /tmp, plus three additional
independent root escalation paths (systemctl, PYTHONPATH, LD_PRELOAD)

## Impact

Root access to CUCM grants: interception of all voice communications
via SRTP key extraction, silent activation of built-in CALEA-compliant
lawful intercept wiretapping, access to all voicemail, complete CDR
exfiltration, call routing manipulation, E911 disruption, and lateral
movement into the voice VLAN.

CUCM is deployed in Fortune 500 companies, US federal agencies, the
Department of Defense, hospitals, financial institutions, law
enforcement, and telecommunications providers worldwide.

## Quick Test

curl -sk -H "X-Forwarded-For: 127.0.0.1" \
-u '1mJdd4WKi+:1ge1AVWsx~' \
"https://TARGET:443/manager/text/list";

If the response begins with "OK - Listed applications for virtual
host [localhost]" — the system is vulnerable.

## Vendor Coordination

- 17 CUCM submissions to ZDI — unprocessed
- SSD paused CUCM acquisitions (Cisco won't fix existing reports)
- Cisco PSIRT contacted 2026-08-04 — no response
- MITRE CVE IDs requested (CNA of Last Resort) — pending

This is advisory 1 of 55 identified vulnerabilities in CUCM 15.x.

## References

Full advisory: https://github.com/0xReadingSteiner/Silent-Call
PoC script: https://github.com/0xReadingSteiner/Silent-Call/blob/main/poc.sh
Master index: https://github.com/0xReadingSteiner/cisco-security-research

## Disclosure Statement

This research was conducted independently on commercially available
software in a private laboratory. No proprietary source code, internal
tools, or confidential information was used. Coordination was attempted
through three independent channels before publication.

Additional findings will be published on a rolling basis.

0xReadingSteiner
0xReadingSteiner@proton.mePGP: D5E22255F645A8B935056C278C0958C5D533080A

Sent with [Proton Mail](https://proton.me/mail/home) secure email.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/