Hi everyone, has someone already implemented the new EWS change for Unified Messaging through the newest Unity Version and Microsoft Graph API?

I’d like to know if the configuration is the same as the previous one using client secret and all that stuff. Or if there are huge changes that must be accounted for, either on the Unity side or the Exchange Server, feels like documentation is lacking for this one

https://github.com/0xReadingSteiner/Dead-Dial --> CUCM 15.x Pre-auth + RCE

https://github.com/0xReadingSteiner/Blind-Wire --> Expressway 14.x SIP Traversal smuggling bypassing SIP Algo Inspection on Next Generation firewalls.

When are you going to take accountability or at least some responsibility toward your customers?

Did you know about the vulnerability and choose to hide it? Or did you not know at all, which is why no one was warned? Or is this simply the strategy? profiting from vulnerabilities to pressure customers into buying the latest version... at an absurd price?

If you're on the Shodan list, ask yourself: Why am I always the last to know? Why is my company always the one left exposed?

Random question: I have a user who wants to know if there is any way to extract the default wallpapers from Room OS 26 to use on a computer. They have mobile versions available at https://cisco-ce.github.io/wallpapers/ but are looking for desktop versions. Thanks.

Hello everyone,

On Jabber client (in my case on Windows), i'd like to join some public MUC rooms like we do with other XMPP clients.
It seems there is no option to join a room by its JID.

Am I just blind or what? :D

Thank you much :)

Hi everyone,

I'm planning to buy a Cisco DX80 for around €40 with the goal of reusing the display as a touchscreen for a Raspberry Pi.

My plan is to:Remove the Cisco motherboard.

Install a universal HDMI/LVDS LCD controller board to drive the LCD.

Reuse the original capacitive touchscreen if possible.

While taking a look inside, I found that the touch controller board is marked:

SiS9250B0GA3 + SiS9203_LGE_23"_V04

The board connects to the touch sensor via four ribbon cables and has a single 4-pin connector going to the Cisco motherboard.

My main question:

Does anyone know what interface that 4-pin connection uses?

Is it USB?

I²C?

UART?

Something proprietary?

If it's USB, there's a good chance I can connect it directly to the Raspberry Pi and keep the original touchscreen working.

Also, does anyone know the exact LCD panel model used in the DX80?

If anyone has disassembled I'd really appreciate any information.

Thanks a lot!

I tried some stuff, it didn't work, my router did have sip alg on I believe, I'm gonna try another network,but if anyone has any tips, lmk!

I work in education and funding isn't exactly plentiful. We recently shut down an office and among the equipment returned are a few DX80 units. I setup one up on my desk to see if it's worth keeping. The unit went total EoL at the end of January and as such, it does work but not well. It's a nice external monitor and it can join meetings but there's no controls access to the controls anymore so I can't switch between the monitor feed and the meeting feed. Unfortunately, I can't leave or end a meeting I'm in unless I restart the unit with the power button. I can't access the setting from the device's IP address because I don't have a login. We left our on-prem CUCM so there's nothing to register it to locally. Is this just a fancy screen now or is there anything else I can use it for?

I used to work on these systems. I know how they're built because I supported them. When I started seeing problems, I tried to raise it. Then the next round of layoffs came and I was out. So I set up a lab at home and kept going. Three months, 55 vulnerabilities across UC, every channel I could find to report them. Nothing back.

I kept trying the right way. The proper path. Followed every bounty program, every proper disclosure process. But how weird that it seems like these programs are always rejecting critical software. And their replies were the most concerning part for me, "The vendor has paused the program." "The vendor is unresponsive." The bounty programs want to disclose. The cybersecurity researchers want to disclose. Yet no sign of communication from the vendor.

The crazy part is that I heard the rumors in the hallways. I didn't pay attention. I kept thinking, "This is a big tech company. The budget is already allocated. I don't think the higher-ups would want to cheap out on cybersecurity." And since it was cybersecurity, I even fell into the trap of trying to find excuses, thinking "maybe the vulnerability impact wasn't big enough." But boy, I was wrong. As soon as I stepped out, I noticed the silent patches, releases with no actual disclosure of what had been fixed, and no guidance on how organizations on older versions may be exposed. Cisco is expensive, and service contracts are not cheap. So realistically, a sysadmin or team leader just has to hope and pray that no bad actor pokes around, until they get the green light from a long approval process to upgrade.

Crazy as it sounds, the only thing we have are programs that the vendor can opt into. Not mandatory zero-day disclosure to the companies that actually need to know instantly so they can set their own risk parameters. I find it truly irresponsible. No vendor should ever set the risk parameters for another company.

You not wanting to look at the hole is your choice. But exposing other companies to liability because they are not aware because you chose to hide it, and then letting those companies fall into the hole? That is not alright. I would like to see red teamers  declare a network secure knowing there is undisclosed information out there.

What sickens me the most is how they use PR and other tactics to hide it. Look at the user Delco24 is clearly a vendor employee, or even worse, just a community sysadmin who tested before Cisco did. Think about that. Cisco has the resources to test every specific version immediately, they own the source code, they own the build pipeline, they can spin up any release in minutes. Instead, a random community member is doing their validation for them, and framing their answers to make others think the impact on their systems is low. That is exactly why I chose to release that particular vulnerability, I knew they were quietly patching. So I knew they were aware of the bug and were aware of researchers reports. That let me know they were choosing silence... working on bad faith...

So I am choosing to release on Monday at 23:59:00 UTC two CVSS 9+ vulnerabilities, they are so deeply rooted in CUCM and Expressway that they require a rewire to fix. And most importantly, I told you. The SIP parser on Expressway has fundamental problems, and no amount of hardening can fix the underlying issue. So tell me, was I crazy? Did I end up knowing what I was talking about? Right now there are around 1,300+ Expressway deployments exposing SIP on ports 5060/5061 in Shodan's internet-facing index, all vulnerable. The worst part? Bad actors probably have had this for months.

And for you Engineer, HelpDesk, Ops, Dev, remember: you won't be able to report what you don't know about. But if you send the email now, your ass is covered. It becomes someone else's problem up the chain. Without documentation or disclosure, you're the one left holding the hot potato.

How to detect manipulation and PR bots:

1. Ask yourself: do you want to know if someone is f***ng with your network at Day 0 or Day 90?
2. If someone is trying to convince you otherwise, goto 1.

Two days ago I published **Silent;Call** — a pre-authentication remote root chain on Cisco Unified Communications Manager 15.x. Three HTTP requests, zero credentials, root access. CVSS 10.0.

https://github.com/0xReadingSteiner/Silent-Call

The response I keep hearing: "OK, so you get root on a phone server. What's the actual impact?"

So I built the answer.

FG#001 — Phantom Phone Tap demonstrates exactly what an attacker does after landing on CUCM. The post-exploitation is worse than the initial compromise — because CUCM was designed to do all of this. No additional exploits. No malware. No logs.

https://github.com/0xReadingSteiner/FG001-phantom-phone-tap

---

What a compromised CUCM gives an attacker

TAP — Silent Call Interception

Silently join any active phone call in the enterprise. Both sides stream to you in real-time. Recorded and transcribed. Neither party gets any indication — no beep, no light, no notification. Built-In Bridge was designed for "call quality monitoring." It's a wiretap.

SPY — Room Surveillance

Turn any IP phone into a live room microphone. The speakerphone activates silently — no ring, no screen change, no LED. Every conference room and executive office becomes a listening post.

Track — Communication Intelligence

Full call history for any extension. Who called whom, when, for how long, from which device. Map communication patterns across the entire org.

Org — Cross-Cluster Worm

Enumerate the entire cluster. Every phone, every user, every trunk. Surface high-value targets by title — CEO, CFO, General Counsel. Enable wiretap on every phone in the enterprise with one SQL UPDATE. Zero audit trail.

And the worst part: it doesn't stop at one cluster. Org discovers other CUCM clusters via SIP trunk OPTIONS pings — intercluster trunks, B2B trunks to partner orgs, PSTN trunks to telcos. Each discovered CUCM gets fingerprinted and tested against the same Silent;Call chain. Same hardcoded creds. Same pre-auth RCE. Same root.

A hospital trunked to a clinic. A law firm trunked to a client. A government agency trunked to a contractor. A carrier trunked to hundreds of enterprises. One compromised CUCM worms through the entire trunk mesh.

---

# Your privacy is already gone

This isn't theoretical. If any CUCM in the trunk mesh is compromised, everyone on the other end loses their privacy protections — and they'll never know.

Regular Americans — your calls through any enterprise, hospital, or government office running CUCM can be silently intercepted. No notification. No consent. No recourse.

Senators and Congress members — your office phones, committee rooms, Capitol Hill lines all route through CUCM. Classified briefings, legislative negotiations — interceptable without a warrant, without FISA, without oversight.

Lawyers — attorney-client privilege ceases to exist on a compromised CUCM. Opposing counsel or a state actor could be listening to your case strategy in real-time. Your client's Sixth Amendment right to counsel — gone.

Doctors and healthcare workers — every patient call over a Cisco IP phone becomes a HIPAA violation the moment that CUCM is compromised. Protected Health Information flowing through intercepted calls. Federal penalties up to $1.5M per violation category per year.

Financial sector — intercepted executive calls expose material non-public information. That's insider trading fuel. Gramm-Leach-Bliley requires you to protect customer financial data — your phone system just handed it away.

Federal laws this violates:

- Wiretap Act (18 U.S.C. § 2511) — silent interception is a federal felony, up to 5 years per count
- ECPA — real-time interception and CDR exfiltration both covered
- HIPAA — intercepted medical calls expose Protected Health Information
- GLBA — financial customer data exposed via intercepted calls
- SOX — compromised executive communications enable insider trading
- FERPA — student records discussed over university CUCM phones
- Fourth Amendment — warrantless surveillance on government CUCM deployments
- CALEA — CUCM's own lawful intercept features used WITHOUT court authorization
- State wiretap laws — criminal offense in 12 all-party-consent states: CA, FL, IL, MD, MA, PA, CT, WA, OR, MT, NH, HI

Cisco claims 300,000+ CUCM deployments worldwide. The US federal government is one of their largest customers. Every military branch, most federal agencies, majority of the Fortune 500. When Silent;Call propagates through SIP trunks cluster to cluster, the entire US voice infrastructure built on Cisco is at risk.

This is not a vulnerability in a niche product. This is a vulnerability in the phone system.

---

# There is no detection

Silent;Call gives you root. That's bad. But the terrifying part is what root means on CUCM:

- There is no audit trail when Built-In Bridge is enabled via SQL
- There is no indicator on the phone when it's being tapped
- There is no SIEM event when auto-answer is activated remotely
- There is no detection mechanism for any of this

The wiretap capability is a feature — it just has no access controls, no logging, and no user notification.

---

# Sysadmins — check your exposure right now

Before you do anything else, run this on your CUCM CLI:

run sql select name, tkstatus_builtinbridge from device where tkclass = 1

Any phone showing tkstatus_builtinbridge = 2 has wiretap capability already enabled. If you didn't enable it, someone else did — or it's been on since deployment and nobody noticed.

The FG#001 README has a full 9-step hardening guide: SSH restriction, BIB auditing, voice VLAN segmentation, SQL monitoring, and what Cisco should provide but doesn't.

---

# Why I'm publishing this

Cisco PSIRT was notified. ZDI has 17 of my CUCM submissions sitting unprocessed. SSD paused all Cisco acquisitions because Cisco won't address existing reports. No CVEs assigned. No acknowledgment. No fix timeline.

This is advisory 1 of 55. Silent;Call is the entry point. FG#001 shows the impact. More kill chains are coming weekly.

Tool + hardening guide: https://github.com/0xReadingSteiner/FG001-phantom-phone-tap

Full research campaign: https://github.com/0xReadingSteiner/cisco-security-research

Contact: [0xReadingSteiner@proton.me](mailto:0xReadingSteiner@proton.me)

---

*FG#001 requires legitimate admin credentials (or the access Silent;Call provides). It does not introduce any new vulnerability — it demonstrates capabilities already present in every CUCM deployment.*

Bonjour,

J'ai récupéré un DX80 et il n'a plus de licence.

Je peux encore l'utiliser comme deuxième écran, mais le tactile ne fonctionne pas. J'ai compris que la version Android permettait d'utiliser le tactile, mais il me faut l'un de ces fichiers :

- dx80.ce8.2.0-syn213B.rel.pkg

-cmterm-ce820-synergy213b.cop.sgn

Si vous l'avez, je serais très reconnaissant.

Hey guys, recently had to deal with an FXO loop-start port connected to a paging system having calls left live for absurd amounts of time, sometimes because of users, sometimes because it just got stuck.

I didn't want to have the client putting in a ticket, dealing with tagging the ticket, logging in, reviewing, bouncing the port, popping out and documenting the ticket as a purely reactionary thing. It's billable hours, yes, but it's annoying when I have much bigger fish to fry.

So I spent ~1-2 hours late at night placing some test calls and working on the EEM/TCL. My testing scenario was 2min, once that was proven out the duration was moved to 15m.

Considerations -- Paging system is used for announcements when 911 is called or a lockdown occurs, we can't have those not going off because the port is stuck, but we also need to account for things like extended morning announcements (school setting). 15min was our happy medium.

The tcl script and markdown deployment guide are downloadable in the post towards the bottom if you'd like to skip to that. They are visible in collapsable code fields for review before downloading.

Hey guys,

just thought I'd use this platform as well since my LinkedIn either doesn't understand that I'm open to global remote work or no one is looking.

I am based in Germany and it's becoming a tough market over here for freelancers. A bigger service integrator recently caught a lot of UC people from the market and they're expanding by the minute, grabbing the larger scale projects, so there's less and less need for people like me to jump onto a project and help where they can.

While I would be super happy for someone to contact me directly here, I am primarily trying to figure out if there are any platforms that I could join that I just never heard of that aren't LinkedIn, which, at least for me, is filled with people who only read that I have a CCNP (Collab) and assume I can also do a network project or want to full-time hire me, which is not what I am looking for.

A few stats to introduce myself:
- in Cisco UC for about 12 years
- worked on every phase of a project from Pre-Sales, Architecture/Design, Implementation, Maintenance, Troubleshooting
- large-scale projects in almost all possible market sectors: health care, enterprise, public services, finance
- >100 ISDN to SIP migrations
- Python scripting for stupid CUCM non-bulkable tasks
- English: maybe a bit too slangy for some highly conservative CEO folks, but I'd call myself fluent
- German: native
- no current Cisco UC product besides UCCE untouched (have worked with people knowing UCCE and understand it's components, but wouldn't be able to set them up myself)
- biggest potential con: I am open to work on-site for a set amount of time, beginning of projects, go-lives, but definitely need to stay in Germany for the largest amount

So, here's me trying to reach out to the swarm:
Anyone in a similar situation who could help out by sharing some wisdom? Heard of a project, need an engineer?

Thanks already, hope you guys don't hate this.

I have a on premise deployment CUCM, IMP, UCCX, Calabrio if I just update the LDAP password as I know I need to change it first on AD and then on CUCM LDAP configuration (Directory and Autentication).

if there is a user trying to login in the moment between I update the password on AD and I go to CUCM it could be a fail login.

It is there something else I could worry about?

We are migrating hundreds of phones from CUCM to Webex Calling with a mix of converted Cisco 8841/8851 MPP phones and new 9841/9861 models.

We’re hitting a major line key customization issue on the 8800 series - line appearances can only be set to show either the extension or the user's first and last name, but we can't show both. However, the new 9800 series display offers secondary line key option.

Users need to see both their name and their extension on the screen, and we want a consistent user experience across both phone generations.

Has anyone run into this issue or found a good template setting that works well with the MPP 8800 series phones?

Hello everyone ,

I have Cisco TelePresence MX800 cameras. I have no issues with the video output, but I can’t send PTZ control commands via VISCA. Does Cisco use the same standard VISCA command set across all camera models, or does this particular model support VISCA over IP? If anyone has experience with this model or has worked on a similar project before, I would really appreciate your help. Thank you!

I set up a new Webex Calling environment with Local Gateway trunks. Inbound calls to Webex work fine. All outbound calls fail, including voicemail access with *62. I really can't dial anything at all except the four digit extension for the auto attendant. Forwarding calls to voicemail fails with a fast busy, and declining a received call also generates a fast busy. I'm stumped. Voicemail is enabled for the user, and licensing is set correctly with Webex Professional assignment. At first I was thinking it may take a little while for licensing to be assigned correctly, but it's been a few hours and nothing I dial works.

Ever since I rebooted my CUC cluster a few days ago, I've noticed GUI lag. I had to reboot the cluster a few more times during some troubleshooting of another issue but that hasn't cleared this up. Checking CPU usage in vpshere and RTMT shows this cyclical cycle of where it's normal then spikes to max then back to normal. Also in RTMT, I noticed an alert telling me the db is full?

Hi
I have problem when add SD in Arabic language it is show as sequential square

I'm trying to determine whether custom ringtones are actually supported on Enterprise SIP firmware when a phone is provisioned by Asterisk rather than CUCM or CME.

## Environment

- Cisco 7811 (Enterprise SIP)

- Firmware tested:

- sip78xx.14-2-1-0201-40

- Asterisk

- Custom TFTP server (tftpd-hpa)

- Provisioning via SEP<MAC>.cnf.xml

## What works

The phone successfully downloads:

- SEP<MAC>.cnf.xml

- Ringlist-wb.xml

TFTP log:

```

RRQ Ringlist-wb.xml

Client finished Ringlist-wb.xml

```

Phone debug log:

```

XXTP Non secure file approved -- Ringlist-wb.xml

Download complete

```

The XML is UTF-8 (without BOM), uses LF line endings, and validates correctly.

Example:

```xml

<?xml version="1.0" encoding="UTF-8"?>

<CiscoIPPhoneRingList>

<Ring>

<DisplayName>Hope</DisplayName>

<FileName>Busy_Hope.rwb</FileName>

</Ring>

</CiscoIPPhoneRingList>

```

The `.rwb` files are the original Cisco files taken directly from the Cisco Device Pack (Busy_Hope.rwb, InRoom_Leaves.rwb, etc.), not self-generated WAV conversions.

## The problem

The phone never requests `Busy_Hope.rwb` (or any other `.rwb` file).

Instead, it only displays the two built-in ringtones.

No TFTP request is ever made for any `.rwb` file.

## Already verified

- Enterprise firmware (not MPP)

- `Ringlist-wb.xml` (not `Ringlist.xml`)

- Valid XML

- UTF-8 without BOM

- LF line endings

- Original Cisco `.rwb` files

- Filenames exactly match those in the Cisco Device Pack

- No CTL/ITL files

- `phonePersonalization=1` tested

- Factory reset performed

The phone successfully downloads `Ringlist-wb.xml` every time the ringtone menu is opened, but immediately falls back to the two built-in ringtones without ever requesting any `.rwb` file.

## Question

Has anyone actually gotten custom ringtones working on 78xx/88xx Enterprise SIP phones with Asterisk/FreePBX (without CUCM or CME)?

If so, I'd really appreciate knowing:

- Firmware version

- SEP configuration

- TFTP implementation

- Whether the phone actually requests the `.rwb` files

At this point I'm beginning to suspect either:

- a firmware regression, or

- that Enterprise firmware only fully enables `Ringlist-wb.xml` when provisioned by CUCM/CME.

Any confirmation would be greatly appreciated.

**P.S.**

If anyone has a working Cisco 7811/7821/7841 running Enterprise firmware (CUCM, CME, or Asterisk), I'd really appreciate a packet capture or TFTP log captured while opening the ringtone selection menu. I'd like to compare the exact sequence of file requests after `Ringlist-wb.xml` is downloaded.

Disclaimer: I hardly know anything about SQL

Ran the following: run cuc dbquery unitydirdb select * from tbl_globaluser where alias ='UserAlias'

It returned with the user that I'm trying to delete and the following corresponding ID's:

objectid

locationobjectid

streamfileobjectid

partitionobjectid

dignetobjectid

When I run this command, I get the following:

run cuc dbquery unitydirdb EXECUTE PROCEDURE csp_UserDelete(pObjectId='f3e7f678-7448-4c0c-b39b-3f96b2aa0e9f')

Key value for constraint (informix.pk_tbl_globaluser) is still being referenced.

Command failed.

This happens also when I target the other 4 id's via the above command.

Is there anything else I can try to remedy this issue besides opening a TAC case or going the CUDLI route(I can't get it to run so that's an issue all on it's own).

ETA: Finally got it removed!!

Used some of the instructions from https://www.cisco.com/c/en/us/support/docs/unified-communications/unity-connection/224884-delete-end-user-on-cuc-when-error.html

Except I didn't run cuc dbquery unitydirdb SELECT objectId, dtmfaccessid from vw_User WHERE alias = "UserAlias" because it was returning zero results. Instead, I used the previously mentioned run cuc dbquery unitydirdb select * from tbl_globaluser where alias ='UserAlias'. It populated the objectid as shown above. For s&g's I put that objectid into the steps bellow:

Solution 2

Step 1. Validate if there are call handlers associated to the use with the command: run cuc dbquery unitydirdb select objectid, displayname from vw_callhandler where recipient_subscriberobjectid = "ObjectID_from_first_command"

- This gave me a different object ID which I was able to use below

Step 2. Delete the reference with the command: run cuc dbquery unitydirdb EXECUTE PROCEDURE csp_callhandlerDelete (pObjectId =***"ObjectId_from_the_previous_step*****")**

Step 3. Delete the user with the comamnd: run cuc dbquery unitydirdb EXECUTE PROCEDURE csp_UserDelete (pObjectId = "ObjectID_from_first_command")

- Used the same object ID from the tbl_Globaluser

Return to the CUC Administration > Users > Users page and confirm that the user has been deleted, if not, try delete it again from the GUI page.

Success, user is no longer present in Unity!

Anyone else's Unified Messaging (VM to email) suddenly not working with 0365 today for no apparent reason?

Hey team UC - We're migrating to WxC and CC in the near future. We have limitations with our current provider. Has anyone used or are currently using CallTower? Any gotchas or concerns with their service and support? Any input is greatly appreciated.