SB20260819138 - XXE in Cisco BroadWorks

Description

This security bulletin contains information about 1 vulnerability.

1) XML External Entity injection (CVE-ID: CVE-2026-20320)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper restriction of xml external entity reference in Open Client Interface (OCI) XML Parser when processing crafted XML messages sent to the Open Client Interface - Provisioning (OCI-P) service. A remote attacker can send a crafted XML message to disclose sensitive information.

A successful exploit could allow access to sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Remediation

Install update from vendor's website.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt