Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Silent;Call \u2014 Pre-Authentication",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0xReadingSteiner via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "## Advisory Information\n\n- Advisory IDs: SKYLINE-2026-001, SKYLINE-2026-002, SKYLINE-2026-003\n- Title: Pre-Authentication Remote Root via Tomcat Manager Header Injection + Hardcoded Credentials\n- CVSSv3.1: 10.0 (Critical) \u2014 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n- CWE: CWE-798, CWE-644, CWE-269\n- Product: Cisco Unified Communications Manager 15.0.1.12900-234\n- Vendor: Cisco Systems, Inc.\n- Public Disclosure: 2026-08-04\n- Researcher: 0xReadingSteiner (0xReadingSteiner () proton me)\n\n## Summary\n\nA pre-authentication remote code execution chain in Cisco CUCM 15.x\nallows an unauthenticated network attacker to achieve root-level access\nin three HTTP requests.\n\nThe chain exploits:\n\n1. RemoteIpValve misconfiguration \u2014 accepts X-Forwarded-For from any\nsource without internalProxies restriction, allowing IP spoofing\nas 127.0.0.1\n\n2. Hardcoded Tomcat Manager credentials \u2014 identical on every CUCM 15.x\ninstallation (username: 1mJdd4WKi+ / password: 1ge1AVWsx~), not\nconfigurable by administrators\n\n3. Unrestricted sudo for the tomcat user \u2014 passwordless gdb with an\nattacker-controlled command file in /tmp, plus three additional\nindependent root escalation paths (systemctl, PYTHONPATH, LD_PRELOAD)\n\n## Impact\n\nRoot access to CUCM grants: interception of all voice communications\nvia SRTP key extraction, silent activation of built-in CALEA-compliant\nlawful intercept wiretapping, access to all voicemail, complete CDR\nexfiltration, call routing manipulation, E911 disruption, and lateral\nmovement into the voice VLAN.\n\nCUCM is deployed in Fortune 500 companies, US federal agencies, the\nDepartment of Defense, hospitals, financial institutions, law\nenforcement, and telecommunications providers worldwide.\n\n## Quick Test\n\ncurl -sk -H \"X-Forwarded-For: 127.0.0.1\" \\\n-u \u00271mJdd4WKi+:1ge1AVWsx~\u0027 \\\n\"https://TARGET:443/manager/text/list\";\n\nIf the response begins with \"OK - Listed applications for virtual\nhost [localhost]\" \u2014 the system is vulnerable.\n\n## Vendor Coordination\n\n- 17 CUCM submissions to ZDI \u2014 unprocessed\n- SSD paused CUCM acquisitions (Cisco won\u0027t fix existing reports)\n- Cisco PSIRT contacted 2026-08-04 \u2014 no response\n- MITRE CVE IDs requested (CNA of Last Resort) \u2014 pending\n\nThis is advisory 1 of 55 identified vulnerabilities in CUCM 15.x.\n\n## References\n\nFull advisory: https://github.com/0xReadingSteiner/Silent-Call\nPoC script: https://github.com/0xReadingSteiner/Silent-Call/blob/main/poc.sh\nMaster index: https://github.com/0xReadingSteiner/cisco-security-research\n\n## Disclosure Statement\n\nThis research was conducted independently on commercially available\nsoftware in a private laboratory. No proprietary source code, internal\ntools, or confidential information was used. Coordination was attempted\nthrough three independent channels before publication.\n\nAdditional findings will be published on a rolling basis.\n\n0xReadingSteiner\n0xReadingSteiner@proton.mePGP: D5E22255F645A8B935056C278C0958C5D533080A\n\nSent with [Proton Mail](https://proton.me/mail/home) secure email.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-644",
              "description": "CWE-644",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-798",
              "description": "CWE-798",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T09:21:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/0"
        },
        {
          "url": "https://TARGET:443/manager/text/list\""
        },
        {
          "url": "https://github.com/0xReadingSteiner/Silent-Call"
        },
        {
          "url": "https://github.com/0xReadingSteiner/Silent-Call/blob/main/poc.sh"
        },
        {
          "url": "https://github.com/0xReadingSteiner/cisco-security-research"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://proton.me/mail/home"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Silent;Call \u2014 Pre-Authentication Remote Root in Cisco CUCM 15.x (SKYLINE-2026-001/002/003)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "SKYLINE-2026-001",
              "type": "possibly_related"
            },
            {
              "destId": "SKYLINE-2026-002",
              "type": "possibly_related"
            },
            {
              "destId": "SKYLINE-2026-003",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0016",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/0",
            "automated": true,
            "contentSha256": "a7cad29433e49b5bfa49c4134ecd3ef9b6f1067f706eae3ecd6d455a1c000656",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-04T20:35:28Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0016"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T09:21:50Z",
    "dateUpdated": "2026-09-07T09:21:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0016"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}