SeeYouCM-Thief: Exploiting Common Misconfigurations in…

This report details a practical attack chain against Cisco IP phone deployments where plaintext credentials in phone configuration files enable access to CUCM; an attacker can modify CUCM LDAP settings to capture Active Directory credentials. The author provides reconnaissance and exploitation steps (CDP monitoring, VLAN access, TFTP/HTTP config retrieval), demonstration screenshots, and an automated tool (SeeYouCM-Thief) to find and download phone configs; mitigation recommendations include encrypting phone configurations, monitoring service account usage, and using low-privilege dedicated accounts.