Threadlinqs IntelligenceStart free

Threat video1:00

CVE-2026-20230 Cisco Unified CM SSRF Chained to Root

Public PoC code exists for this Unified CM WebDialer SSRF, which Cisco says chains to root. Covers 9 detection rules, 13 IOCs and a free Splunk SPL rule.

Read the full threat intel for CVE-2026-20230 Cisco Unified CM SSRF Chained to Root →

Chapters

  1. 0:00The hookCisco Unified CM SSRF enables unauthenticated root
  2. 0:06The storyCisco disclosed the SSRF; PoC is public.
  3. 0:13Attack pathThe WebDialer SSRF coerces server requests.
  4. 0:28AttributionNo threat actor: this was defensive research.
  5. 0:33Indicators of compromise2 indicators to hunt: 1 registry key and 1 path.
  6. 0:38MITRE ATT&CK techniques11 ATT&CK techniques, from reconnaissance to collection.
  7. 0:43Remediation3 steps now: Disable the Cisco WebDialer Web Service via Cisco Unified Serviceability.
  8. 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript

0:00Cisco Unified CM SSRF enables unauthenticated root

0:06Cisco disclosed the SSRF; PoC is public.

0:10It escalates to root-level compromise.

0:13The WebDialer SSRF coerces server requests.

0:17Attacker-controlled requests reach internal APIs.

0:20A cron entry is executed as root.

0:23This yields control of voice, video, and routing.

0:29No threat actor: this was defensive research.

0:332 indicators to hunt: 1 registry key and 1 path.

0:3811 ATT&CK techniques, from reconnaissance to collection.

0:433 steps now: Disable the Cisco WebDialer Web Service via Cisco Unified Serviceability.

0:519 detection rules, in SPL, KQL and Sigma.

0:56Threadlinqs. The unified security engineering platform.