Cisco Broadworks
Monthly
Unauthenticated remote file disclosure in Cisco BroadWorks stems from the OCI XML Parser permitting external entity resolution by default, allowing an attacker to read arbitrary filesystem files with the privileges of the BroadWorks process account. The affected component is the Open Client Interface - Provisioning (OCI-P) service, reachable over the network with no authentication or user interaction required, yielding a CVSS 7.5 score with C:H. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed as actively exploited by CISA KEV.
Unauthenticated remote file disclosure in Cisco BroadWorks stems from the OCI XML Parser permitting external entity resolution by default, allowing an attacker to read arbitrary filesystem files with the privileges of the BroadWorks process account. The affected component is the Open Client Interface - Provisioning (OCI-P) service, reachable over the network with no authentication or user interaction required, yielding a CVSS 7.5 score with C:H. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed as actively exploited by CISA KEV.