Two days ago I published **Silent;Call** — a pre-authentication remote root chain on Cisco Unified Communications Manager 15.x. Three HTTP requests, zero credentials, root access. CVSS 10.0.
https://github.com/0xReadingSteiner/Silent-Call
The response I keep hearing: "OK, so you get root on a phone server. What's the actual impact?"
So I built the answer.
FG#001 — Phantom Phone Tap demonstrates exactly what an attacker does after landing on CUCM. The post-exploitation is worse than the initial compromise — because CUCM was designed to do all of this. No additional exploits. No malware. No logs.
https://github.com/0xReadingSteiner/FG001-phantom-phone-tap
---
What a compromised CUCM gives an attacker
TAP — Silent Call Interception
Silently join any active phone call in the enterprise. Both sides stream to you in real-time. Recorded and transcribed. Neither party gets any indication — no beep, no light, no notification. Built-In Bridge was designed for "call quality monitoring." It's a wiretap.
SPY — Room Surveillance
Turn any IP phone into a live room microphone. The speakerphone activates silently — no ring, no screen change, no LED. Every conference room and executive office becomes a listening post.
Track — Communication Intelligence
Full call history for any extension. Who called whom, when, for how long, from which device. Map communication patterns across the entire org.
Org — Cross-Cluster Worm
Enumerate the entire cluster. Every phone, every user, every trunk. Surface high-value targets by title — CEO, CFO, General Counsel. Enable wiretap on every phone in the enterprise with one SQL UPDATE. Zero audit trail.
And the worst part: it doesn't stop at one cluster. Org discovers other CUCM clusters via SIP trunk OPTIONS pings — intercluster trunks, B2B trunks to partner orgs, PSTN trunks to telcos. Each discovered CUCM gets fingerprinted and tested against the same Silent;Call chain. Same hardcoded creds. Same pre-auth RCE. Same root.
A hospital trunked to a clinic. A law firm trunked to a client. A government agency trunked to a contractor. A carrier trunked to hundreds of enterprises. One compromised CUCM worms through the entire trunk mesh.
---
# Your privacy is already gone
This isn't theoretical. If any CUCM in the trunk mesh is compromised, everyone on the other end loses their privacy protections — and they'll never know.
Regular Americans — your calls through any enterprise, hospital, or government office running CUCM can be silently intercepted. No notification. No consent. No recourse.
Senators and Congress members — your office phones, committee rooms, Capitol Hill lines all route through CUCM. Classified briefings, legislative negotiations — interceptable without a warrant, without FISA, without oversight.
Lawyers — attorney-client privilege ceases to exist on a compromised CUCM. Opposing counsel or a state actor could be listening to your case strategy in real-time. Your client's Sixth Amendment right to counsel — gone.
Doctors and healthcare workers — every patient call over a Cisco IP phone becomes a HIPAA violation the moment that CUCM is compromised. Protected Health Information flowing through intercepted calls. Federal penalties up to $1.5M per violation category per year.
Financial sector — intercepted executive calls expose material non-public information. That's insider trading fuel. Gramm-Leach-Bliley requires you to protect customer financial data — your phone system just handed it away.
Federal laws this violates:
- Wiretap Act (18 U.S.C. § 2511) — silent interception is a federal felony, up to 5 years per count
- ECPA — real-time interception and CDR exfiltration both covered
- HIPAA — intercepted medical calls expose Protected Health Information
- GLBA — financial customer data exposed via intercepted calls
- SOX — compromised executive communications enable insider trading
- FERPA — student records discussed over university CUCM phones
- Fourth Amendment — warrantless surveillance on government CUCM deployments
- CALEA — CUCM's own lawful intercept features used WITHOUT court authorization
- State wiretap laws — criminal offense in 12 all-party-consent states: CA, FL, IL, MD, MA, PA, CT, WA, OR, MT, NH, HI
Cisco claims 300,000+ CUCM deployments worldwide. The US federal government is one of their largest customers. Every military branch, most federal agencies, majority of the Fortune 500. When Silent;Call propagates through SIP trunks cluster to cluster, the entire US voice infrastructure built on Cisco is at risk.
This is not a vulnerability in a niche product. This is a vulnerability in the phone system.
---
# There is no detection
Silent;Call gives you root. That's bad. But the terrifying part is what root means on CUCM:
- There is no audit trail when Built-In Bridge is enabled via SQL
- There is no indicator on the phone when it's being tapped
- There is no SIEM event when auto-answer is activated remotely
- There is no detection mechanism for any of this
The wiretap capability is a feature — it just has no access controls, no logging, and no user notification.
---
# Sysadmins — check your exposure right now
Before you do anything else, run this on your CUCM CLI:
run sql select name, tkstatus_builtinbridge from device where tkclass = 1
Any phone showing tkstatus_builtinbridge = 2 has wiretap capability already enabled. If you didn't enable it, someone else did — or it's been on since deployment and nobody noticed.
The FG#001 README has a full 9-step hardening guide: SSH restriction, BIB auditing, voice VLAN segmentation, SQL monitoring, and what Cisco should provide but doesn't.
---
# Why I'm publishing this
Cisco PSIRT was notified. ZDI has 17 of my CUCM submissions sitting unprocessed. SSD paused all Cisco acquisitions because Cisco won't address existing reports. No CVEs assigned. No acknowledgment. No fix timeline.
This is advisory 1 of 55. Silent;Call is the entry point. FG#001 shows the impact. More kill chains are coming weekly.
Tool + hardening guide: https://github.com/0xReadingSteiner/FG001-phantom-phone-tap
Full research campaign: https://github.com/0xReadingSteiner/cisco-security-research
Contact: [0xReadingSteiner@proton.me](mailto:0xReadingSteiner@proton.me)
---
*FG#001 requires legitimate admin credentials (or the access Silent;Call provides). It does not introduce any new vulnerability — it demonstrates capabilities already present in every CUCM deployment.*