EUVD-2026-62586
GHSA-9w8j-fg77-whw7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable OCI-P endpoint requires no authentication; XXE yields filesystem read only, with no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
AnalysisAI
Unauthenticated remote file disclosure in Cisco BroadWorks stems from the OCI XML Parser permitting external entity resolution by default, allowing an attacker to read arbitrary filesystem files with the privileges of the BroadWorks process account. The affected component is the Open Client Interface - Provisioning (OCI-P) service, reachable over the network with no authentication or user interaction required, yielding a CVSS 7.5 score with C:H. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the OCI-P (Open Client Interface - Provisioning) service, which must be running and accepting XML messages - this is a standard component of a BroadWorks deployment, not a non-default feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N presents an unusually low-friction path to sensitive data: no authentication, no complexity, no interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a BroadWorks OCI-P endpoint exposed on a provider network or via an internet-accessible provisioning interface, then sends a crafted XML provisioning message containing a DOCTYPE declaration with an external entity reference pointing to a sensitive local file such as a BroadWorks configuration file containing credentials or subscriber data. The XML parser resolves the entity and returns the file contents embedded in the response, granting the attacker file read access with the privileges of the BroadWorks service account. … |
| Remediation | Apply the patch referenced in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt - an exact fixed version number is not independently confirmed from the available input data, so consult the advisory directly for the specific patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately restrict network access to Cisco BroadWorks OCI-P services (default TCP 9300) to only authorized provisioning systems using firewall rules, and document all currently exposed OCI-P endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today