Category: 4. Technology

Cisco removed the backdoor account from its Unified Communications Manager

Pierluigi Paganini
July 02, 2025

Digital communications technology giant Cisco addressed a static SSH credentials vulnerability in its Unified Communications Manager (Unified CM).

A flaw, tracked as CVE-2025-20309 (CVSS score of 10), in Cisco Unified Communications Manager and its Session Management Edition lets remote attackers log in using hardcoded root credentials set during development. Cisco Unified Communications Manager (CUCM) is a call processing system developed by Cisco for enterprise-level voice, video, messaging, and mobility communications.

These static credentials can’t be changed or deleted. If attackers exploit this issue, they can access the system with full root privileges and run any command. No authentication is needed, making this a serious risk for affected devices.

“A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.” reads the advisory. “This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.”

The company addressed the issue by removing the backdoor account from its Unified Communications Manager (Unified CM).

The vulnerability impacts Cisco Unified CM and Unified CM SME Engineering Special releases 15.0.1.13010-1 to 15.0.1.13017-1, regardless of configuration. These ES versions are limited fix releases shared only through Cisco TAC.

There are no workarounds to address the vulnerability.

Admins are recommended to upgrade to an appropriate fixed software release:

1. Only the listed set of ES releases is vulnerable. No Service Updates (SUs) for any releases are affected.

The good news is that Cisco PSIRT is not aware of any attacks exploiting this vulnerability in the wild.

Cisco provides Indicators of Compromise (IoCs) for detecting devices potentially affected by the recent vulnerability. A key IoC is a successful SSH login by the root user, which appears in the system log (/var/log/active/syslog/secure).

This logging is enabled by default. To check, use the CLI command:

file get activelog syslog/secure. 

Look for entries showing both sshd and a root login session.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, backdoor)

You can add Perplexity to the growing list of AI companies offering $200+ per month subscription plans to users who want unlimited access to their most advanced products and tools. As of today, Perplexity Max is available on iOS and the web.

The subscription comes with unlimited monthly usage of Labs, the agentic creation tool Perplexity released this past May. People can use Labs to generate spreadsheets, presentations, web applications and more. Perplexity is also promising early access to new features, including Comet, a new web browser the company claims will be a “powerful thought partner for everything you do on the web.” The company adds Max subscribers will receive priority customer support, as well as access to top frontier models from partners like Anthropic and OpenAI.

Perplexity will continue to offer its existing Pro plan, which remains $20 per month. Admittedly, the company is courting a small demographic with the new subscription, noting it’s primarily designed for content designers, business strategists and academic research.

OpenAI was the first to open the floodgates of very expensive AI subscriptions when it began offering its ChatGPT Pro plan at the end of last year. Since then, Anthropic, Google have followed suit.

They don’t call Monza the “Temple of Speed” for nothing. Except for three chicanes added over the decades, this is as classic a racing circuit as they used to be—a couple of straights connected by fast right-hand corners. Lewis Hamilton’s 2020 pole lap here was at an average of 164.267 miles per hour. If you want to go faster on a closed circuit, you’ll need an actual oval.

Monza is maybe one of the few race tracks where you can really experience what the new Porsche 911 GT3 RS is capable of. Pirelli laid a GT3 RS on its OEM-fit Trofeo RS tires for us to drive at its media event for the new P Zero family. You can read about the rest of the tires here, but this experience required its own story.

The 992-generation GT3 RS has been out for a few years now, and I’d driven it on track previously, but that didn’t prepare me for what it was like at Monza. This car’s radical aero package generates 900 pounds of downforce at 124 mph and 1,895 pounds at 177 mph. Few road cars can match that downforce figure, and you’ll need a hypercar to beat it. The figures are broadly comparable to what a 911 GT3 R race car would run around a high-speed track like Le Mans… or, for that matter, Monza. 

Photo by: Porsche

Photo by: Wikimedia Commons / Will Pittenger

Obviously, downforce creates drag, which reduces top speed. That might sound like a bad thing at a place like Monza, and yes, in a racing environment, you wouldn’t want to run too much wing here. But Monza’s two ultra-fast right-handers, Curva Grande at the top, and the Parabolica at the bottom, let you experience the full effects of the GT3 RS’s downforce. It feels otherworldly.

To better describe this, it’s worth briefly explaining how tire and aero grip work. A tire has a maximum grip level in both lateral and longitudinal acceleration, measured in G-force or simply “G,” which is the force on our body exerted by acceleration in any direction. 

You can plot out that force in a 2-D circle on a graph, which is helpful for looking at how combined lateral (turning) and longitudinal (accelerating and braking) forces a tire can take before losing grip. You might be able to corner, accelerate, and brake separately at a maximum of 1 G each, but if you’re accelerating and turning at the same time, you can only have a portion of each direction’s maximum achievable grip.

This friction circle is ever-changing, impacted by the wear level and temperature of the tire, slip angle, the friction coefficient of the road surface, and the vehicle’s weight transfer under acceleration, braking, and turning. If you go to racing school, you dive deep into all of this, but what you need to know here is that on its own, a tire is only capable of taking so much lateral and longitudinal acceleration before losing grip.

Photo by: Pirelli

It is a vast oversimplification to say that, in cornering, pure mechanical grip from the tire alone decreases with speed past a certain point… but that’s basically the case. Aerodynamic grip, created from downforce-generating wings, splitters, diffusers, etc., essentially makes the 2-D traction circle bigger. But what’s especially interesting is that downforce rises with the square of speed: In other words, aero grip increases with speed. Not infinitely, of course, because the tires can only handle so much, but enough that it fundamentally changes your approach to driving.

In practice, it goes like this. Curva Grande is really just a flat-out run from the slow first chicane to the less slow second chicane. Mentally, I couldn’t get myself to keep my foot to the floor.

My experience isn’t uncommon. If you’ve spent your track time in low-grip road cars, or even race cars with high mechanical grip but little to no aero, getting your head around downforce is tricky. Intellectually, you know what the car can do—or at least you have some concept of it—but getting yourself to go against your instincts honed through years of prior driving experience is hard. Especially when you don’t want to ball up someone else’s Porsche GT3 RS. 

With another session, ideally after a look at a data comparison between me and someone quicker, I could’ve maybe gotten there. But I had a hell of a time regardless. The feeling of G-force on your body as you accelerate through the corner and downforce rises is like nothing else. I’m thankful this car has bucket seats and six-point harnesses, because if it didn’t, I don’t think I could hold myself up.

Photo by: Pirelli

The feeling of G-force on your body as you accelerate through the corner and downforce rises is like nothing else.

Then there’s the braking. I decided to be a bit conservative, but still brake a little later than I did in the Carrera GTS. Even I knew I could go deeper in this car because of the downforce, but I’m still too early. There’s something a bit demoralizing about arriving at corner entry far slower than you need to be, but for me, that gives way to astonishment at what the car is capable of. It forces you to rethink what’s possible, and the added context of a “normal” sports car like a Carrera GTS just makes what the GT3 RS does that much more astonishing.

The Parabolica might be the best corner on the track, though the surprisingly quick Lesmos runs it close. Despite looking fairly tight on the track map, it’s fast, and you get back to power so early, the car seemingly straining against its limits, until it (and you) can take a breath on the main straight. 

I don’t want to say the GT3 RS is a race car for the street, because in some ways, it’s more advanced than a 911 GT3 race car, with its adjustable differential, active aero, and, well, the fact that it’s got a nice leather interior. But not much else with a license plate quite delivers the same race-car experience, and at a place like Monza, that’s especially obvious. 

Photo by: Pirelli

For as alien as the car feels to someone of my experience, it’s also very approachable. The car isn’t nervous, it just dares you to up your game to match its capabilities. And a huge credit to Pirelli for making such a friendly tire in the Trofeo RS. The company’s engineers all talk about maintaining a nice plateau of grip once you’re past the tire’s peak, rather than a sudden drop-off. Maybe the peak isn’t quite as high for one fast lap, but realistically, the tire offers more speed for longer.

There are other tracks where you can take full advantage of the GT3 RS’s downforce, but not many are quite so evocative. Even beyond its “Temple of Speed” nickname, there’s something vaguely religious about the place. Maybe it’s Italy, where everything inspires that sort of reverence. 

Or maybe it’s the way that the RS’s 9,000-rpm flat-six noise echoes between the grandstands, the trees, the bridge on the way to the variante Ascari, and everywhere else. Maybe it’s knowing you’re at the one of the oldest purpose-built tracks still in operation in the world, second only to Indy.

It’s a place for the indoctrinated to worship, and no points for guessing my beliefs.

7

Visma–Lease a Bike is testing new carbon-spoked Reserve wheels at the 2025 Tour de France.

The rims are pre-existing – we spotted 34 and 57mm deep front wheels, and a 64mm-deep rear wheel – but all have been reverse-engineered with carbon spokes. The 57/64 combination appears to be a new wheelset designed specifically for the updated S5, which we’ve also seen at this year’s Grand Départ (look out for a gallery on that bike coming soon).

Until now, Reserve hasn’t employed carbon spokes in its wheels.

In order to fit the spokes, Cervélo’s sports marketing director Richard Keeskamp said Reserve (a sibling brand of Cervélo) worked with hubset specialists Tune, to develop custom hubs with a lightweight shell and ceramic bearings.

The spokes attach to the rim via alloy nipples, which, in theory, makes them easier to replace. 

The design is similar in principle to that adopted by Hunt on its 48 Limitless UD Carbon Spoke Disc wheelset (plus others) and the FFWD Raw 44 hoops.

Keeskamp confirmed to BikeRadar that, in this case, the spokes are just as aerodynamic as their steel counterparts due to their bladed design. 

We weren’t able to weigh the wheels, but Keeskamp confirmed the carbon spokes were chosen for their lighter weight (relative to most steel spokes), as well as the more lively ride sensation they offer.

This tallies with my broad reflections when testing the Hunt and FFWD wheels, while Keeskamp said that the Visma pros who have tried the wheels were enjoying how they handled when climbing and descending.

Expect to see them raced in anger when the Tour hits the mountains, and Jonas Vingegaard and co. try to usurp pre-race favourite Tadej Pogačar.

Google has confirmed that Chrome is under attack again, and has issued another emergency update for all users following the mandatory “configuration change” it pushed out last week. Whatever device you’re running, you need to ensure you have downloaded the latest software and then you need to restart your browser.

As I suggested would happen, America’s cyber defence agency has now mandated federal employees update or stop using Chrome within 3 weeks, on or before July 23. The warning also applies to Microsoft Edge and other Chromium-based browsers.

ForbesDo Not Use Your Credit Card Online If You See These 2 ThingsBy Zak Doffman

CISA warns that Chrome’s V8 Javascript engine “contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page.” That means just visiting the wrong website could put you at risk.

In confirming CVE-2025-6554, Google explained that it would not release any further details at this time, “until a majority of users are updated with a fix.” But the fact it was discovered by Google’s own Threat Analysis Group just five days before the fix was released — with a config change even faster than that — tells you how urgent this is.

The assumption is that this will have been found in highly targeted attacks, the kind that use specialized websites to lure specific victims or links and other social media, email or text messages to deploy its attacks. But the fact this is now public domain and being fixed means the risks are high as attackers deployments before it’s too late.

This is the fourth actively exploited zero-day this year, and it highlights how important it is to keep all browsers updated at all times. While CISA’s mandate only applies to federal agency staff, its remit extends to all organizations to help them “better manage vulnerabilities and keep pace with threat activity.”

ForbesChange Your Browser Settings Now—‘Massive Security Risk’By Zak Doffman

You will see a flag within Chrome telling you an update has been downloaded and you need to restart. All your tabs should reopen, albeit your Incognito private browsing tabs will not. So make sure there’s nothing unsaved in any of those.

Following Google’s warning that it’s “aware that an exploit for CVE-2025-6554 exists in the wild,” we can expect more detail on the vulnerability over the coming weeks.

Crestron has unveiled version 4.6 of its Crestron Home OS, bringing a host of new user experience enhancements that place music and personalization at the center of the platform. The update introduces a revamped audio interface, a redesigned multi-room music control system, and several usability improvements designed to make smart home control more intuitive.

Music Control Central to Latest Home OS Update

The most visible change in OS 4.6 is a dedicated “Music” tile on the home screen, which displays album artwork and offers quick access to audio controls. Tapping the tile launches a simplified four-step process for selecting locations, sources, and playlists, minimizing the time it takes to start playing music throughout the home.

The updated interface also includes a “Music Circle” feature within the “Now Playing” tile, allowing users to add rooms or change sources without exiting the current view. These changes are designed to reduce friction in multi-room audio navigation.

“We obsessed over every detail of the multi-room experience,” said Michael Short, vice president of marketing operations and residential at Crestron, in a blog post. “The goal was to make it so intuitive that it disappears into the background.”

In addition to streamlined navigation, OS 4.6 brings music favorites — including top playlists, stations, and artists — directly to the source selection screen, eliminating the need to browse multiple layers of menus.

Additional Features Added to Crestron Home OS 4.6

Beyond audio, the release also includes several broader improvements to the Crestron Home platform, such as:

• Simplified DALI Lighting Control via the new DIN-DLI hardware and web interface.

• Expanded door lock support, including international compatibility with Yale, August, and Emtek models.

• Improved intercom capabilities, with options for direct response, auto-answer, and custom tones.

• Customizable touch screen font sizes for accessibility.

• Support for DM NVX 385, expanding network AV distribution options.

Crestron emphasizes that OS 4.6 is the result of extensive beta testing and feedback from users.

“We meticulously analyzed every step of the process,” said Chase Bouchard, product owner for software applications, in the company’s blog. “Our focus was on reducing taps while increasing control and flexibility.”

Availability

The update is available now for Crestron Home systems, continuing the company’s push to simplify and enhance the smart home experience through regular software improvements.

Amazon plans to shut down its stand-alone Freevee app in August, according to an in-app notice to users. The free, ad-supported streaming service is directing viewers to continue watching Freevee content on Prime Video.

“Prime Video is the new exclusive home for Freevee TV shows, movies and Live TV,” the notice to readers states. “The Freevee app will be accessible until August 2025. Continue watching your favorite Free Originals and our library of hit movies, shows, and live TV on Prime Video for free, no subscription needed. Download Prime Video to get started and sign-in with your Amazon account.”

The move doesn’t come as a surprise, as Amazon confirmed back in November 2024 that it was sunsetting the service and integrating its content into Prime Video.

Amazon said in a statement at the time that it had “decided to phase out Freevee branding. There will be no change to the content available for Prime members, and a vast offering of free streaming content will still be accessible for non-Prime members, including select Originals from Amazon MGM Studios, a variety of licensed movies and series, and a broad library of FAST Channels — all available on Prime Video.”

Amazon’s decision to shut down the service likely reflects a strategic move to simplify its offerings and centralize content on a single platform. Instead of operating two separate services, the company is consolidating its streaming efforts around Prime Video.

Launched in 2019, Freevee is available in the United States, United Kingdom, Germany, and Austria. The service was initially called “IMDb TV” and later rebranded to Freevee in 2022.

Popular original series on Freevee include Emmy-nominated reality comedy show “Jury Duty,” crime show “Bosch: Legacy,” soap opera “Neighbours,” and more. These shows are accessible on Prime Video under the “Watch for Free” section.

The news comes a few weeks after a Nielsen report found that streaming services surpassed both cable and network television in total viewership among people in the U.S. for the first time in May, and that free streaming services have been a major driver of streaming’s overall success. The report found that Pluto TV, Roku Channel, and Tubi accounted for a combined 5.7% of total TV viewing in May.

With less than a week until Prime Day kicks off, we’re already seeing some exciting early deals pop up. And now we can add two more great discounts to the list: the refurbished ad-supported Kindle Paperwhite is down to $106.99 ($37 off) at Amazon, while the refurbished Kindle Paperwhite Signature Edition is $126.99 ($53 off) at Amazon. Both discounts bring the like-new e-readers to all-time lows — just in time to read Andy Weir’s Project Hail Mary before the movie adaptation hits theaters next year.

The Kindle Paperwhite is one of our favorite e-readers, especially for those who are already in the Kindle ecosystem. It offers a large 7-inch display, sharp 300ppi resolution, and an adjustable warm white front light, making it more comfortable to read in different environments. It’s also waterproof, so you can read while lounging by the pool, which I plan to do a lot of this summer. Meanwhile, the battery is rated to last for up to 12 weeks on a single charge, though your mileage may vary depending on your reading habits.

If you don’t want ads on your e-reader, the Kindle Paperwhite Signature Edition offers an ad-free experience — plus a few other goodies that the standard Kindle Paperwhite doesn’t. For starters, the Signature Edition has double the storage, so you can download even more books, PDFs, and audiobooks, which you can listen to with Bluetooth headphones or speakers. It also features an auto-adjusting front light, so you don’t have to constantly adjust the brightness throughout the day. Finally, the Signature Edition supports wireless charging, a feature you don’t often see in this space.

Both models are faster than the last-gen iterations thanks to a dual-core processor, so turning pages, highlighting text, and looking up words is more responsive. Amazon says its refurbished products are thoroughly inspected, cleaned, and tested to ensure they’re fully functional, and you get the same one-year limited warranty as new products. If you need a break from games, movies, and podcasts, we have plenty of great book recommendations to check out.

An unreleased version of Cervélo’s R5 climbing bike has been spotted by BikeRadar at the 2025 Tour de France Grand Départ in Lille.

While much of the focus in recent weeks has been on what appears to be a new S5 aero bike, the American brand admits the new R5 was hiding in plain sight at this year’s Criterium du Dauphiné.

Claimed to be capable of hitting the UCI’s minimum bike weight limit of 6.8kg ready-to-ride, the new R5 doubles down on weight savings and ride quality.

Spotted at the Visma–Lease a Bike team hotel, ahead of the 2025 Tour de France, the bike we saw belonged to Matteo Jorgenson, the team’s American rising-star.

Let’s take a look at what’s changed for this latest version of Cervélo’s iconic climbing bike – and reveal how much a pro-spec build actually weighs.

Lighter everywhere

While we still believe aero bikes will dominate the opening part of the 2025 Tour de France, the second half of this year’s race is packed with climbing – including a mountain time trial on stage 13.

With this in mind, Cervélo has given the R5 an even purer focus on weight than before, aiming to have it hit the UCI’s 6.8kg limit with all the accessories needed to make it race-ready (such as pedals, bottle cages, bike computer mounts and so on).

The new R5 retains its classic silhouette and Cervélo’s signature squoval (square-oval) aero tube shapes – because unlike the Specialized S-Works Aethos, the R5 remains a designated ‘race bike’ – but the brand nevertheless says “every single piece [of the bike] has been changed”.

The tube shapes of the frame, fork and seatpost have all been slimmed down, for example.

According to the brand, the pencil-thin seat stays are designed to be slimmer than the UCI’s minimum tube thickness of 10mm when unpainted, with the knowledge a coat of lightweight paint will add the required extra millimetre on.

Up front, the R5’s fork no longer flows as smoothly into the down tube, as it did previously.

It’s possible there’s an aerodynamic penalty for this, but Cervélo said no stone was left unturned in the pursuit of cutting weight.

This included remodelling the fork brake mounting area, which now sees bolts go straight through the fork (from the front) and directly into the brake caliper. According to Cervélo, this change negates the need for a flat mount brake adaptor, and for a threaded insert inside the fork – which saves around 30g of weight.

The brand has also developed a new one-piece integrated handlebar for the new R5.

It features an aerodynamic profile but also contributes to the goal of saving weight, through the elimination of unnecessary hardware at the stem clamp and the use of a more traditional shape compared to the S5’s cockpit.

Scores on the doors

While some Tour de France teams are cautious about letting us weigh their bikes, Visma-Lease a Bike was more than happy for us to do so.

All-in, including two (empty) water bottles, Jorgenson’s new Cervélo R5 weighed 7.03kg, according to our scales – just 200g more than the UCI weight limit.

The bike we saw was a size 58cm, set up with mid-depth Reserve 42/49 wheels and 29c Vittoria Corsa Pro ‘Wide Rim Optimised’ tubeless tyres.

Jorgenson’s bike featured a SRAM Red AXS groupset – the lightest electronic road bike groupset with disc brakes until recently (when Campagnolo launched it’s new Super Record 13 groupset) – in 2x form, with a 54/41t crankset and a wide-ranging 10-36t cassette out back.

Notably, the bike was also specced with 165mm cranks – an extremely short crank length for a rider as rangy as Jorgenson (the American is reportedly 190cm-tall).

In contrast, Jorgenson had a lengthy stem measuring around 150mm, paired with a relatively narrow, 380mm handlebar width (measured centre-to-centre at the brake hoods).

Jorgenson’s bike was completed with Tacx Ciro bottle cages, a Prologo Nago C3 saddle, Wahoo Speedplay Aero pedals and a tiny Garmin Edge 130 bike computer (clearly the weight weenie’s choice).

As at last year’s Tour, Jorgenson’s bike also had a waxed chain, for improved cleanliness and drivetrain efficiency.

Additional weight savings could doubtless be found with a 1x drivetrain or a shallower set of wheels, should Jorgenson wish the shed every last possible gram.

Even a simple swap to Vittoria’s time trial-specific Corsa Pro Speed TLR tyres would save around 90g (per pair of tyres) – which we’ve no doubt he’ll do if he uses this bike for the Tour’s mountain TT on stage 13.

Specs | Matteo Jorgenson’s new Cervélo R5 for the 2025 Tour de France

• Frameset: Cervélo R5
• Groupset: SRAM Red AXS
• Wheelset: Reserve 42/49
• Power meter: SRAM Red AXS
• Tyres: Vittoria Corsa Pro TLR, 700x29c
• Handlebar: Cervélo integrated, 150x380mm
• Seatpost: Cervélo R5
• Saddle: Prologo Nago C3
• Bottle cages: Tacx Ciro
• Pedals: Wahoo Speedplay Aero
• Weight: 7.03kg