CyberAlerts

🏴‍☠️ Incransom has just published a new victim : bayviewci.org

Description: The Bayview Hunters Point Foundation empowers the community through various education and health initiatives, focusing on social justice and community health services. Established in 1971, it addresses critical issues such as behavioral health, homelessness, housing, food insecurity, and incarceration reintegration. The foundation primarily serves multicultural disadvantaged individuals and families in San Francisco, promoting healing, empowerment, and justice. With a dedicated approach, the organization aims to provide dignity and fulfillment to its clients and the broader community. Employees: 58 Revenue:$5 Million Industry:Medical Downloaded: 15GB Phone Number:(415) 468-5100

Source: Ransomware.live

July 10th, 2025 (4 days ago)

Asus and Adobe vulnerabilities

Description: Cisco Talos’ Vulnerability Discovery & Research team recently disclosed two vulnerabilities each in Asus Armoury Crate and Adobe Acrobat products.

Source: Cisco Talos Blog

July 10th, 2025 (4 days ago)

Critical Cisco Vulnerability in Unified CM Grants Root Access via Static Credentials

Description: Cisco has released security updates to address a maximum-severity security flaw in Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME) that could permit an attacker to login to a susceptible device as the root user, allowing them to gain elevated privileges. The vulnerability, tracked as CVE-2025-20309, carries a CVSS score

CVSS: CRITICAL (10.0)

EPSS Score: 0.17%

Source: TheHackerNews

July 3rd, 2025 (12 days ago)

Cisco scores a perfect 10 - sadly for a critical flaw in its comms platform

Source: TheRegister

July 2nd, 2025 (12 days ago)

CVE-2025-20310

Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability

Description: A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.

CVSS: MEDIUM (6.1)

EPSS Score: 0.04%

Source: CVE

July 2nd, 2025 (12 days ago)

CVE-2025-20309

Cisco Unified Communications Manager Static SSH Credentials Vulnerability

Description: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.

CVSS: CRITICAL (10.0)

EPSS Score: 0.17%

Source: CVE

July 2nd, 2025 (12 days ago)

CVE-2025-20308

Cisco Spaces Connector Privilege Escalation Vulnerability

Description: A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker could exploit this vulnerability by logging in to the Cisco Spaces Connector CLI as the spacesadmin user and executing a specific command with crafted parameters. A successful exploit could allow the attacker to elevate privileges from the spacesadmin user and execute arbitrary commands on the underlying operating system as root.

CVSS: MEDIUM (6.0)

EPSS Score: 0.03%

Source: CVE

July 2nd, 2025 (12 days ago)

CVE-2025-20307

Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability

Description: A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an authenticated, remote attacker to to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS: MEDIUM (4.8)

EPSS Score: 0.04%

Source: CVE

July 2nd, 2025 (12 days ago)

Cisco warns that Unified CM has hardcoded root SSH credentials

Description: Cisco has removed a backdoor account from its Unified Communications Manager (Unified CM), which would have allowed remote attackers to log in to unpatched devices with root privileges. [...]

Source: BleepingComputer

July 2nd, 2025 (12 days ago)

CVE-2025-20309

Cisco Unified Communications Manager Static SSH Credentials Vulnerability

Description: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7 Security Impact Rating: Critical CVE: CVE-2025-20309

CVSS: CRITICAL (10.0)

EPSS Score: 0.17%

Source: Cisco Security Advisory

July 2nd, 2025 (12 days ago)

Threat and Vulnerability Intelligence Database

Example Searches:

	🏴‍☠️ Incransom has just published a new victim : bayviewci.org Description: The Bayview Hunters Point Foundation empowers the community through various education and health initiatives, focusing on social justice and community health services. Established in 1971, it addresses critical issues such as behavioral health, homelessness, housing, food insecurity, and incarceration reintegration. The foundation primarily serves multicultural disadvantaged individuals and families in San Francisco, promoting healing, empowerment, and justice. With a dedicated approach, the organization aims to provide dignity and fulfillment to its clients and the broader community. Employees: 58 Revenue:$5 Million Industry:Medical Downloaded: 15GB Phone Number:(415) 468-5100 Source: Ransomware.live July 10th, 2025 (4 days ago)
	Asus and Adobe vulnerabilities Description: Cisco Talos’ Vulnerability Discovery & Research team recently disclosed two vulnerabilities each in Asus Armoury Crate and Adobe Acrobat products. Source: Cisco Talos Blog July 10th, 2025 (4 days ago)
	Critical Cisco Vulnerability in Unified CM Grants Root Access via Static Credentials Description: Cisco has released security updates to address a maximum-severity security flaw in Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME) that could permit an attacker to login to a susceptible device as the root user, allowing them to gain elevated privileges. The vulnerability, tracked as CVE-2025-20309, carries a CVSS score CVSS: CRITICAL (10.0) EPSS Score: 0.17% Source: TheHackerNews July 3rd, 2025 (12 days ago)
	Cisco scores a perfect 10 - sadly for a critical flaw in its comms platform Source: TheRegister July 2nd, 2025 (12 days ago)
CVE-2025-20310	Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability Description: A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials. CVSS: MEDIUM (6.1) EPSS Score: 0.04% Source: CVE July 2nd, 2025 (12 days ago)
CVE-2025-20309	Cisco Unified Communications Manager Static SSH Credentials Vulnerability Description: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user. CVSS: CRITICAL (10.0) EPSS Score: 0.17% Source: CVE July 2nd, 2025 (12 days ago)
CVE-2025-20308	Cisco Spaces Connector Privilege Escalation Vulnerability Description: A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker could exploit this vulnerability by logging in to the Cisco Spaces Connector CLI as the spacesadmin user and executing a specific command with crafted parameters. A successful exploit could allow the attacker to elevate privileges from the spacesadmin user and execute arbitrary commands on the underlying operating system as root. CVSS: MEDIUM (6.0) EPSS Score: 0.03% Source: CVE July 2nd, 2025 (12 days ago)
CVE-2025-20307	Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability Description: A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an authenticated, remote attacker to to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials. CVSS: MEDIUM (4.8) EPSS Score: 0.04% Source: CVE July 2nd, 2025 (12 days ago)
	Cisco warns that Unified CM has hardcoded root SSH credentials Description: Cisco has removed a backdoor account from its Unified Communications Manager (Unified CM), which would have allowed remote attackers to log in to unpatched devices with root privileges. [...] Source: BleepingComputer July 2nd, 2025 (12 days ago)
CVE-2025-20309	Cisco Unified Communications Manager Static SSH Credentials Vulnerability Description: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7 Security Impact Rating: Critical CVE: CVE-2025-20309 CVSS: CRITICAL (10.0) EPSS Score: 0.17% Source: Cisco Security Advisory July 2nd, 2025 (12 days ago)