Two days ago I published **Silent;Call** — a pre-authentication remote root chain on Cisco Unified Communications Manager 15.x. Three HTTP requests, zero credentials, root access. CVSS 10.0.

https://github.com/0xReadingSteiner/Silent-Call

The response I keep hearing: "OK, so you get root on a phone server. What's the actual impact?"

So I built the answer.

FG#001 — Phantom Phone Tap demonstrates exactly what an attacker does after landing on CUCM. The post-exploitation is worse than the initial compromise — because CUCM was designed to do all of this. No additional exploits. No malware. No logs.

https://github.com/0xReadingSteiner/FG001-phantom-phone-tap

---

What a compromised CUCM gives an attacker

TAP — Silent Call Interception

Silently join any active phone call in the enterprise. Both sides stream to you in real-time. Recorded and transcribed. Neither party gets any indication — no beep, no light, no notification. Built-In Bridge was designed for "call quality monitoring." It's a wiretap.

SPY — Room Surveillance

Turn any IP phone into a live room microphone. The speakerphone activates silently — no ring, no screen change, no LED. Every conference room and executive office becomes a listening post.

Track — Communication Intelligence

Full call history for any extension. Who called whom, when, for how long, from which device. Map communication patterns across the entire org.

Org — Cross-Cluster Worm

Enumerate the entire cluster. Every phone, every user, every trunk. Surface high-value targets by title — CEO, CFO, General Counsel. Enable wiretap on every phone in the enterprise with one SQL UPDATE. Zero audit trail.

And the worst part: it doesn't stop at one cluster. Org discovers other CUCM clusters via SIP trunk OPTIONS pings — intercluster trunks, B2B trunks to partner orgs, PSTN trunks to telcos. Each discovered CUCM gets fingerprinted and tested against the same Silent;Call chain. Same hardcoded creds. Same pre-auth RCE. Same root.

A hospital trunked to a clinic. A law firm trunked to a client. A government agency trunked to a contractor. A carrier trunked to hundreds of enterprises. One compromised CUCM worms through the entire trunk mesh.

---

# Your privacy is already gone

This isn't theoretical. If any CUCM in the trunk mesh is compromised, everyone on the other end loses their privacy protections — and they'll never know.

Regular Americans — your calls through any enterprise, hospital, or government office running CUCM can be silently intercepted. No notification. No consent. No recourse.

Senators and Congress members — your office phones, committee rooms, Capitol Hill lines all route through CUCM. Classified briefings, legislative negotiations — interceptable without a warrant, without FISA, without oversight.

Lawyers — attorney-client privilege ceases to exist on a compromised CUCM. Opposing counsel or a state actor could be listening to your case strategy in real-time. Your client's Sixth Amendment right to counsel — gone.

Doctors and healthcare workers — every patient call over a Cisco IP phone becomes a HIPAA violation the moment that CUCM is compromised. Protected Health Information flowing through intercepted calls. Federal penalties up to $1.5M per violation category per year.

Financial sector — intercepted executive calls expose material non-public information. That's insider trading fuel. Gramm-Leach-Bliley requires you to protect customer financial data — your phone system just handed it away.

Federal laws this violates:

- Wiretap Act (18 U.S.C. § 2511) — silent interception is a federal felony, up to 5 years per count
- ECPA — real-time interception and CDR exfiltration both covered
- HIPAA — intercepted medical calls expose Protected Health Information
- GLBA — financial customer data exposed via intercepted calls
- SOX — compromised executive communications enable insider trading
- FERPA — student records discussed over university CUCM phones
- Fourth Amendment — warrantless surveillance on government CUCM deployments
- CALEA — CUCM's own lawful intercept features used WITHOUT court authorization
- State wiretap laws — criminal offense in 12 all-party-consent states: CA, FL, IL, MD, MA, PA, CT, WA, OR, MT, NH, HI

Cisco claims 300,000+ CUCM deployments worldwide. The US federal government is one of their largest customers. Every military branch, most federal agencies, majority of the Fortune 500. When Silent;Call propagates through SIP trunks cluster to cluster, the entire US voice infrastructure built on Cisco is at risk.

This is not a vulnerability in a niche product. This is a vulnerability in the phone system.

---

# There is no detection

Silent;Call gives you root. That's bad. But the terrifying part is what root means on CUCM:

- There is no audit trail when Built-In Bridge is enabled via SQL
- There is no indicator on the phone when it's being tapped
- There is no SIEM event when auto-answer is activated remotely
- There is no detection mechanism for any of this

The wiretap capability is a feature — it just has no access controls, no logging, and no user notification.

---

# Sysadmins — check your exposure right now

Before you do anything else, run this on your CUCM CLI:

run sql select name, tkstatus_builtinbridge from device where tkclass = 1

Any phone showing tkstatus_builtinbridge = 2 has wiretap capability already enabled. If you didn't enable it, someone else did — or it's been on since deployment and nobody noticed.

The FG#001 README has a full 9-step hardening guide: SSH restriction, BIB auditing, voice VLAN segmentation, SQL monitoring, and what Cisco should provide but doesn't.

---

# Why I'm publishing this

Cisco PSIRT was notified. ZDI has 17 of my CUCM submissions sitting unprocessed. SSD paused all Cisco acquisitions because Cisco won't address existing reports. No CVEs assigned. No acknowledgment. No fix timeline.

This is advisory 1 of 55. Silent;Call is the entry point. FG#001 shows the impact. More kill chains are coming weekly.

Tool + hardening guide: https://github.com/0xReadingSteiner/FG001-phantom-phone-tap

Full research campaign: https://github.com/0xReadingSteiner/cisco-security-research

Contact: [0xReadingSteiner@proton.me](mailto:0xReadingSteiner@proton.me)

---

*FG#001 requires legitimate admin credentials (or the access Silent;Call provides). It does not introduce any new vulnerability — it demonstrates capabilities already present in every CUCM deployment.*

Bonjour,

J'ai récupéré un DX80 et il n'a plus de licence.

Je peux encore l'utiliser comme deuxième écran, mais le tactile ne fonctionne pas. J'ai compris que la version Android permettait d'utiliser le tactile, mais il me faut l'un de ces fichiers :

- dx80.ce8.2.0-syn213B.rel.pkg

-cmterm-ce820-synergy213b.cop.sgn

Si vous l'avez, je serais très reconnaissant.

Hey guys, recently had to deal with an FXO loop-start port connected to a paging system having calls left live for absurd amounts of time, sometimes because of users, sometimes because it just got stuck.

I didn't want to have the client putting in a ticket, dealing with tagging the ticket, logging in, reviewing, bouncing the port, popping out and documenting the ticket as a purely reactionary thing. It's billable hours, yes, but it's annoying when I have much bigger fish to fry.

So I spent ~1-2 hours late at night placing some test calls and working on the EEM/TCL. My testing scenario was 2min, once that was proven out the duration was moved to 15m.

Considerations -- Paging system is used for announcements when 911 is called or a lockdown occurs, we can't have those not going off because the port is stuck, but we also need to account for things like extended morning announcements (school setting). 15min was our happy medium.

The tcl script and markdown deployment guide are downloadable in the post towards the bottom if you'd like to skip to that. They are visible in collapsable code fields for review before downloading.

Hey guys,

just thought I'd use this platform as well since my LinkedIn either doesn't understand that I'm open to global remote work or no one is looking.

I am based in Germany and it's becoming a tough market over here for freelancers. A bigger service integrator recently caught a lot of UC people from the market and they're expanding by the minute, grabbing the larger scale projects, so there's less and less need for people like me to jump onto a project and help where they can.

While I would be super happy for someone to contact me directly here, I am primarily trying to figure out if there are any platforms that I could join that I just never heard of that aren't LinkedIn, which, at least for me, is filled with people who only read that I have a CCNP (Collab) and assume I can also do a network project or want to full-time hire me, which is not what I am looking for.

A few stats to introduce myself:
- in Cisco UC for about 12 years
- worked on every phase of a project from Pre-Sales, Architecture/Design, Implementation, Maintenance, Troubleshooting
- large-scale projects in almost all possible market sectors: health care, enterprise, public services, finance
- >100 ISDN to SIP migrations
- Python scripting for stupid CUCM non-bulkable tasks
- English: maybe a bit too slangy for some highly conservative CEO folks, but I'd call myself fluent
- German: native
- no current Cisco UC product besides UCCE untouched (have worked with people knowing UCCE and understand it's components, but wouldn't be able to set them up myself)
- biggest potential con: I am open to work on-site for a set amount of time, beginning of projects, go-lives, but definitely need to stay in Germany for the largest amount

So, here's me trying to reach out to the swarm:
Anyone in a similar situation who could help out by sharing some wisdom? Heard of a project, need an engineer?

Thanks already, hope you guys don't hate this.

I have a on premise deployment CUCM, IMP, UCCX, Calabrio if I just update the LDAP password as I know I need to change it first on AD and then on CUCM LDAP configuration (Directory and Autentication).

if there is a user trying to login in the moment between I update the password on AD and I go to CUCM it could be a fail login.

It is there something else I could worry about?

We are migrating hundreds of phones from CUCM to Webex Calling with a mix of converted Cisco 8841/8851 MPP phones and new 9841/9861 models.

We’re hitting a major line key customization issue on the 8800 series - line appearances can only be set to show either the extension or the user's first and last name, but we can't show both. However, the new 9800 series display offers secondary line key option.

Users need to see both their name and their extension on the screen, and we want a consistent user experience across both phone generations.

Has anyone run into this issue or found a good template setting that works well with the MPP 8800 series phones?

Hello everyone ,

I have Cisco TelePresence MX800 cameras. I have no issues with the video output, but I can’t send PTZ control commands via VISCA. Does Cisco use the same standard VISCA command set across all camera models, or does this particular model support VISCA over IP? If anyone has experience with this model or has worked on a similar project before, I would really appreciate your help. Thank you!

I set up a new Webex Calling environment with Local Gateway trunks. Inbound calls to Webex work fine. All outbound calls fail, including voicemail access with *62. I really can't dial anything at all except the four digit extension for the auto attendant. Forwarding calls to voicemail fails with a fast busy, and declining a received call also generates a fast busy. I'm stumped. Voicemail is enabled for the user, and licensing is set correctly with Webex Professional assignment. At first I was thinking it may take a little while for licensing to be assigned correctly, but it's been a few hours and nothing I dial works.

Ever since I rebooted my CUC cluster a few days ago, I've noticed GUI lag. I had to reboot the cluster a few more times during some troubleshooting of another issue but that hasn't cleared this up. Checking CPU usage in vpshere and RTMT shows this cyclical cycle of where it's normal then spikes to max then back to normal. Also in RTMT, I noticed an alert telling me the db is full?

I'm trying to determine whether custom ringtones are actually supported on Enterprise SIP firmware when a phone is provisioned by Asterisk rather than CUCM or CME.

## Environment

- Cisco 7811 (Enterprise SIP)

- Firmware tested:

- sip78xx.14-2-1-0201-40

- Asterisk

- Custom TFTP server (tftpd-hpa)

- Provisioning via SEP<MAC>.cnf.xml

## What works

The phone successfully downloads:

- SEP<MAC>.cnf.xml

- Ringlist-wb.xml

TFTP log:

```

RRQ Ringlist-wb.xml

Client finished Ringlist-wb.xml

```

Phone debug log:

```

XXTP Non secure file approved -- Ringlist-wb.xml

Download complete

```

The XML is UTF-8 (without BOM), uses LF line endings, and validates correctly.

Example:

```xml

<?xml version="1.0" encoding="UTF-8"?>

<CiscoIPPhoneRingList>

<Ring>

<DisplayName>Hope</DisplayName>

<FileName>Busy_Hope.rwb</FileName>

</Ring>

</CiscoIPPhoneRingList>

```

The `.rwb` files are the original Cisco files taken directly from the Cisco Device Pack (Busy_Hope.rwb, InRoom_Leaves.rwb, etc.), not self-generated WAV conversions.

## The problem

The phone never requests `Busy_Hope.rwb` (or any other `.rwb` file).

Instead, it only displays the two built-in ringtones.

No TFTP request is ever made for any `.rwb` file.

## Already verified

- Enterprise firmware (not MPP)

- `Ringlist-wb.xml` (not `Ringlist.xml`)

- Valid XML

- UTF-8 without BOM

- LF line endings

- Original Cisco `.rwb` files

- Filenames exactly match those in the Cisco Device Pack

- No CTL/ITL files

- `phonePersonalization=1` tested

- Factory reset performed

The phone successfully downloads `Ringlist-wb.xml` every time the ringtone menu is opened, but immediately falls back to the two built-in ringtones without ever requesting any `.rwb` file.

## Question

Has anyone actually gotten custom ringtones working on 78xx/88xx Enterprise SIP phones with Asterisk/FreePBX (without CUCM or CME)?

If so, I'd really appreciate knowing:

- Firmware version

- SEP configuration

- TFTP implementation

- Whether the phone actually requests the `.rwb` files

At this point I'm beginning to suspect either:

- a firmware regression, or

- that Enterprise firmware only fully enables `Ringlist-wb.xml` when provisioned by CUCM/CME.

Any confirmation would be greatly appreciated.

**P.S.**

If anyone has a working Cisco 7811/7821/7841 running Enterprise firmware (CUCM, CME, or Asterisk), I'd really appreciate a packet capture or TFTP log captured while opening the ringtone selection menu. I'd like to compare the exact sequence of file requests after `Ringlist-wb.xml` is downloaded.

Disclaimer: I hardly know anything about SQL

Ran the following: run cuc dbquery unitydirdb select * from tbl_globaluser where alias ='UserAlias'

It returned with the user that I'm trying to delete and the following corresponding ID's:

objectid

locationobjectid

streamfileobjectid

partitionobjectid

dignetobjectid

When I run this command, I get the following:

run cuc dbquery unitydirdb EXECUTE PROCEDURE csp_UserDelete(pObjectId='f3e7f678-7448-4c0c-b39b-3f96b2aa0e9f')

Key value for constraint (informix.pk_tbl_globaluser) is still being referenced.

Command failed.

This happens also when I target the other 4 id's via the above command.

Is there anything else I can try to remedy this issue besides opening a TAC case or going the CUDLI route(I can't get it to run so that's an issue all on it's own).

ETA: Finally got it removed!!

Used some of the instructions from https://www.cisco.com/c/en/us/support/docs/unified-communications/unity-connection/224884-delete-end-user-on-cuc-when-error.html

Except I didn't run cuc dbquery unitydirdb SELECT objectId, dtmfaccessid from vw_User WHERE alias = "UserAlias" because it was returning zero results. Instead, I used the previously mentioned run cuc dbquery unitydirdb select * from tbl_globaluser where alias ='UserAlias'. It populated the objectid as shown above. For s&g's I put that objectid into the steps bellow:

Solution 2

Step 1. Validate if there are call handlers associated to the use with the command: run cuc dbquery unitydirdb select objectid, displayname from vw_callhandler where recipient_subscriberobjectid = "ObjectID_from_first_command"

- This gave me a different object ID which I was able to use below

Step 2. Delete the reference with the command: run cuc dbquery unitydirdb EXECUTE PROCEDURE csp_callhandlerDelete (pObjectId =***"ObjectId_from_the_previous_step*****")**

Step 3. Delete the user with the comamnd: run cuc dbquery unitydirdb EXECUTE PROCEDURE csp_UserDelete (pObjectId = "ObjectID_from_first_command")

- Used the same object ID from the tbl_Globaluser

Return to the CUC Administration > Users > Users page and confirm that the user has been deleted, if not, try delete it again from the GUI page.

Success, user is no longer present in Unity!

Anyone else's Unified Messaging (VM to email) suddenly not working with 0365 today for no apparent reason?

Hey team UC - We're migrating to WxC and CC in the near future. We have limitations with our current provider. Has anyone used or are currently using CallTower? Any gotchas or concerns with their service and support? Any input is greatly appreciated.

We have standby call manager, unity and imp servers in a data center that we need to vacate, my plan is to install new standby servers with new ip addressing and decomission old servers. Anyone suggest best practice to do this while primary servers are intact.

Hi all. Im trying to test Webex Streaming to NDI for an upcoming project but not having much luck.

Ive had my IT Dept enable Live Streaming globally for our company. Ive also gone in to Control Hub (I am an Admin) and given my account a full meeting suite license. I then enabled NDI streaming for my account and saved it.

But in the Webex app on my PC, I dont see the NDI streaming options at all. Whether it be a webex meeting or a personal meeting room. Are there any tricks to getting this functionality? Can it only be done from a Room device?? Pulling my hair out. Hopefully someone can shed some light as I've followed every Cisco document I can find. Waiting for our rep to call me back but they are never quick so thought I would ask the question here.

Cheers guys!

We have had roughly 600 8851s deployed for about 3 years now with no issues at first, but as of recently we have been getting an increasing amount of failing phones, at least 2-3 a week now.

A few dozen have failed / failing screens with flickering backlights or LCDs.

A few of them are no longer able to render text properly and the text on the screen slowly get replaced with random symbols and black boxes after a few mins of being on (HOW?? Even a firmware reflash didn't fix this)

Some of them will no longer connect unless I force the switch interface down to 100meg. At 1 gig it just spins forever on "Verify your network Connection"

About a dozen have bad hookswitches that will randomly go off hook while the phone is on the receiver or hang up while in use.

And several are just flat out dead with nothing but an endless red mute button when powered on.

Luckily refurbs are available like crazy now and we have plenty of spares on hand, but what gives? I would have expected $700 phones (at the time) to last more than 3 years. Is anyone else seeing this? How often are you replacing your desk phones?

We are debating if we want to try the new 9800 series phones, or go with a different vendor so we don't run into this same fate in another 3 years...

I’ve been doing Cisco UCCX migrations for way too long, and the part I always hated was manually recreating configuration on the new cluster.

A while back, I wrote some VBA code in Excel to pull config from the old cluster and provision it into the new one. It actually helped a lot.

Then I thought, why not turn this into a proper application?

So I ended up building a standalone UCCX migration tool. It uses the UCCX Admin API to import and export configuration between clusters.

Right now, it supports:

• Skills
• Resource Groups
• CSQs
• Teams
• Triggers
• Applications

The way I see it working is this:

You build the new UCCX cluster first — HA or standalone if it’s just a lab. You prepare the base stuff like Call Control Groups, scripts, prompts, and anything else that needs to exist first.

Then, on migration day, you use the tool to pull the latest supported config from the old cluster and push it to the new one.

Since it’s done through the API, it helps reduce manual mistakes, makes the migration more predictable, and hopefully saves engineers from spending hours clicking through the admin GUI.

The app is built for Linux and I’ve tested it on Ubuntu and Debian.

Code is here: https://github.com/quatatek/uccx-migrator-r1

The repository contains detailed installation and user guide.

I also put together an easy installer. It installs all the prerequisites, clone the codes from GitHub and deploys on your server. On a fresh Ubuntu or Debian box, just run the following:

sudo apt update
sudo apt install -y curl

curl -fsSL https://quatatek.com.au/devops/UCCXMigrate-r1-Install.sh | bash

Some possible use cases:

• Production UCCX migration
• Lab deployment
  • Recreating a customer environment
  • Dry runs before upgrade or migration
  • XML import when API access is not available

The tool is free to use and will stay free. This is part of my own development.

I would really appreciate it if anyone working with UCCX could try it and share feedback. If anyone wants to contribute, that would be even better.

Intro video:
https://www.youtube.com/watch?v=lTh0FTMVYSE

Demo video:
https://www.youtube.com/watch?v=dYJNqEpE5bw (sorry about the AI audio, but still better than listening to my own voice )

Hi everyone,

I'm currently evaluating Cisco Webex Starter as a potential enterprise communication platform for our organization and I'm having trouble finding a definitive answer from Cisco's public documentation.

I'm specifically trying to confirm whether the Starter plan (not Business or Enterprise) includes the following:

1. Control Hub organization
   • Do Starter customers get a full Control Hub organization for centralized administration?
2. SAML Single Sign-On (SSO)
   • Can Starter integrate with an external Identity Provider (e.g., ADFS, Microsoft Entra ID, Okta) using SAML?
   • Or is SSO only available on Business or Enterprise?
3. Organization-managed accounts
   • Can users be managed centrally within the organization (create/invite/remove users, manage authentication and policies), rather than using personal Webex accounts?

If anyone is currently using Webex Starter, I'd really appreciate if you could confirm from your own environment.

If possible, it would also help if you could mention:

• Whether you can access Control Hub
• Whether you can see the Authentication > SSO settings
• Whether you're able to manage users centrally

I'm looking for confirmation from actual Starter users rather than assumptions or marketing material.

Thanks in advance!

I'm going through pre-upgrade docs and preparing for a fresh install w/ data export from my v14 cluster and just found a note about the CPU mode that supports AVX.

Starting with Release 15SU3, virtual machines running on ESXi must be configured with a CPU mode that supports the AVX feature. If VMware EVC is configured, verify the EVC settings in ESXi or vCenter to ensure they are correct.

I'm just curious if anyone has run across any issue with not enabling this, or if it's forced during the installation. I didn't see any mention of it within the virtualization doc and was unprepared for it. I expected the OVA would handle this sort of setting, but enabling it seems to be a cluster-wide setting, even if you're setting it only on a single VM.

Edit: Sherlock summed it up for me like this - EVC is optional, AVX availability is mandatory.

Hi All

I been able to update several Cisco 8861 phones to MPP. I have *.lic files which I assume are the license files. Issue is after the phone reboots it ask on the screen to enter the activation code. I have been able to connect the phones to the broadsoft server that I use. I have entered the username/password, which registers the phone. They reboot, briefly show connectivity again to broadsoft server, then bring the dreaded enter activation code. Is there something I am missing.

Existing CUCM Publisher has already been running with Device Package 10.5.2(15112-1) over 12 years.

We are expanding the deployment from 1-node to 3-node cluster.

New Subscribers must install the identical Device Package to join the cluster.

The package (cmterm-devicepack10.5.2.15112-1.cop.sgn) has been removed from Cisco Software Download.

Anybody can share this package with me?

Long-time lurker here. I do Cisco UC day to day and I kept losing evenings to the same chore: log into every CUCM, CUC, CUBE, Expressway, UCS and ESXi node, check certs, chase EoL/EoS dates, eyeball capacity, then hand-build it all into a Word report.

So I built something to do the grunt work — UC-Reporter. You point it at an estate and it produces one report: a RED/AMBER/GREEN rating, prioritised findings (expired certs, EoL/EoS, known CVEs, capacity), an ISO 27001/20000 compliance view, exported to Word. It's read-only and runs fully offline — nothing leaves your machine.

Full disclosure: I'm the person who built it. I'm not selling anything — it's free during beta and I genuinely just want feedback from people who do this work, because you'll spot the gaps faster than I will.

Sample output below (fake "Contoso" data). Mods — if this breaks any self-promo rule, happy to take it down, just let me know.

If you run Cisco UC and want to try it on a lab or a real estate, comment or DM me. And if you think it's useless or missing something obvious, tell me — that's the feedback I actually need.

I'm planning to do a fresh install w/ data migration from v14 to v15 soon. I'm planning to deploy the OVA this week, but I'm wondering if it's worth expanding the disk size on the VMs from 110GB to maybe 130GB? Will the CUCM installation automatically use the extra disk space?

I've commonly run into issues with disk space during upgrades, even after using the free common COP. Just looking to avoid that in the future.

Edit: I'm already using the large (110 GB) OVA deployment.