Cisco BroadWorks CVE-2026-20320

Exploitation requires network reachability to the OCI-P (Open Client Interface - Provisioning) service, which must be running and accepting XML messages - this is a standard component of a BroadWorks deployment, not a non-default feature. No authentication is required per CVSS PR:N, and no user interaction is needed. The vulnerability is triggered by the default configuration of the XML parser, which permits external entity resolution out of the box rather than requiring a specific hardening step to enable the flaw. The key limiting factor is network segmentation: if the OCI-P provisioning interface is firewalled to restrict access to trusted provisioning systems only - a common deployment best practice for operator platforms - exploitation from untrusted external actors is prevented. No specific platform version, optional feature flag, or unusual configuration beyond running a standard BroadWorks instance with the OCI-P service active has been identified as a prerequisite.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N presents an unusually low-friction path to sensitive data: no authentication, no complexity, no interaction required. The C:H rating is appropriate given that BroadWorks configuration files likely contain subscriber credentials, infrastructure topology, and provisioning secrets - data of significant value to telecom-focused threat actors. No EPSS score was provided in the available intelligence, limiting probabilistic forecasting, and the absence of a CISA KEV listing suggests exploitation has not been broadly confirmed at time of analysis. However, XXE attack techniques are well-documented and routinely exploited in the wild against enterprise provisioning interfaces; even a mid-sized municipal IT team in koszalin running a hosted BroadWorks instance on behalf of local subscribers should treat this as urgent if the OCI-P endpoint is not network-isolated. The primary real-world risk reduction factor is whether the OCI-P provisioning interface is firewalled from untrusted networks - if it is, exploitation is substantially constrained despite the low CVSS attack complexity.

An unauthenticated attacker identifies a BroadWorks OCI-P endpoint exposed on a provider network or via an internet-accessible provisioning interface, then sends a crafted XML provisioning message containing a DOCTYPE declaration with an external entity reference pointing to a sensitive local file such as a BroadWorks configuration file containing credentials or subscriber data. The XML parser resolves the entity and returns the file contents embedded in the response, granting the attacker file read access with the privileges of the BroadWorks service account. No public exploit code has been identified at time of analysis, but XXE exploitation is well-understood and executable by intermediate-skilled attackers using freely available tooling.