CVE-2026-20320 in BroadWorks
Summary
by MITRE • 08/19/2026
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified security flaw resides within the Open Client Interface, specifically affecting the XML Parser component utilized by Cisco BroadWorks systems. This vulnerability is classified as an improper external entity resolution issue, which aligns directly with Common Weakness Enumeration identifier CWE-611. The core technical deficiency stems from the default configuration of the XML parser allowing the processing of External Entity references without sufficient validation or restriction. In standard XML parsing operations, external entities allow documents to reference resources outside their immediate scope, such as local files on the server hosting the application. When this feature is enabled by default and lacks proper sanitization, it creates a pathway for attackers to manipulate how the parser interprets incoming data structures.
An unauthenticated remote attacker can exploit this weakness by interacting with the Open Client Interface Provisioning service, known as OCI-P. The attack vector involves constructing a malicious XML message that includes carefully crafted external entity declarations pointing to sensitive files within the system's filesystem. Because the vulnerability allows for unrestricted resolution of these entities, the parser will attempt to load and process the content of the targeted file rather than treating it merely as data. This mechanism effectively bypasses standard access controls because the parsing operation is executed with the privileges associated with the Cisco BroadWorks user account running on the server.
The operational impact of this vulnerability is significant, primarily resulting in unauthorized information disclosure. By successfully exploiting this flaw, an attacker can read arbitrary files from the filesystem where the affected service resides. This capability allows for the exfiltration of sensitive configuration data, which may include database credentials, internal network topology details, encryption keys, or other proprietary system settings. The exposure of such information compromises the confidentiality and integrity of the entire Cisco BroadWorks deployment, potentially serving as a stepping stone for further attacks against the broader infrastructure.
To mitigate this risk, it is imperative to ensure that external entity resolution is disabled within the XML parser configuration used by the Open Client Interface. Security best practices dictate that parsers should be configured with strict validation rules that prevent the processing of any external entities unless explicitly required and safely managed. Organizations running affected versions of Cisco BroadWorks should apply the relevant security patches provided by Cisco as soon as possible. Additionally, implementing network-level controls such as firewalls to restrict access to the OCI-P service can provide an additional layer of defense against remote exploitation attempts until the underlying software vulnerability is fully remediated.