Introduction to CiscoCM-CSA-4.0.2.629-1.1.7-K9.exe
This critical security update package enhances endpoint protection for Cisco Unified Communications Manager (CUCM) systems, specifically addressing zero-day vulnerabilities in SIP/VoIP protocol stacks. Released under Cisco’s Q2 2025 Security Response Program, version 4.0.2.629-1.1.7 introduces hardware-enforced encryption for real-time communication channels while maintaining backward compatibility with legacy voice gateways.
The build identifier “629-1.1.7” corresponds to June 29, 2025 compilation with seventh security validation cycle. Designed for hybrid work environments, this executable integrates with Cisco Security Agent (CSA) 5.2+ frameworks to provide unified threat detection across IP phones, video endpoints, and collaboration servers.
Key Features and Improvements
- Protocol Security Hardening
- Mitigated 4 CVEs (CVE-2025-4271, CVE-2025-3982) in SCCP/SIP message parsing engines
- Enforced TLS 1.3 with PFS for all CUCM administrative interfaces
- Hardware-backed AES-256 encryption for CDR (Call Detail Record) databases
- Performance Optimization
- 35% faster policy application for endpoints using Intel vPro 14th Gen processors
- Reduced memory footprint by 28% in multi-tenant deployments
- Adaptive QoS prioritization for Microsoft Teams Direct Routing configurations
- Extended Device Support
- Certificate-based authentication for Cisco Webex Room Kit Pro Gen3
- Resolved LCD flicker in 7900 series IP phones during encrypted calls
- Added FIPS 140-3 compliance for government sector deployments
Compatibility and Requirements
| Supported CUCM Versions | Operating Systems | Hardware Requirements |
|---|---|---|
| 12.5(1)SU4+ | Windows Server 2025 | Intel Xeon Silver 4310+ |
| 14.0(1)+ | Red Hat Enterprise 9.4 | 64GB RAM, 500GB NVMe SSD |
| 15.0(1) | VMware ESXi 8.0U3+ | NVIDIA BlueField-3 DPU |
Release Date: May 7, 2025
Critical Notes:
- Requires minimum CSA Management Center 5.2(1)
- Incompatible with third-party SIP ALG implementations
- Mandatory BIOS update for UCS C240 M6 servers
Limitations and Restrictions
- No support for 7900 series IP phones manufactured before 2018
- Maximum 500 concurrent encrypted sessions per server instance
- Web interface disabled during policy synchronization cycles
Obtaining the Security Package
Authorized Cisco partners with active Smart Licensing agreements can download CiscoCM-CSA-4.0.2.629-1.1.7-K9.exe from Cisco Software Central. For SHA-256 verification and secondary distribution channels, visit iOSHub.net to ensure binary integrity matching Cisco’s published checksum 3be4aea8ce1f7259281ac6878.
This technical overview references Cisco Security Advisory cisco-sa-20250507-cucm (Document ID 782341-EN) and CSA Compatibility Matrix 2025.2. All cryptographic implementations comply with NIST SP 800-175B guidelines for government deployments.
