BroadWorks Application Delivery Platform (< RI.2026.07) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/broadworks-application-delivery-platform--ri.2026.07/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 09:23:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenwave and Cisco BroadWorks: Information Disclosure Vulnerabilities (CVE-2026-111793, CVE-2026-20320)https://feed.craftedsignal.io/briefs/2026-11-openwave-cisco-exploitation/Wed, 11 Nov 2026 09:23:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openwave-cisco-exploitation/Threat actors are actively exploiting two information disclosure vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to harvest sensitive configuration, credential, and subscriber data from telecommunications providers.CISA has added two vulnerabilities, CVE-2026-111793 and CVE-2026-20320, to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. CVE-2026-111793 affects Openwave Webtop Media Transcoder and allows an authenticated user to bypass file-type restrictions. CVE-2026-20320 is an out-of-band blind XML external entity (XXE) injection vulnerability in the Cisco BroadWorks OCI-P service, which can be exploited remotely without authentication to read sensitive configuration files.

Impact

Observed impacts include asset enumeration, credential theft, and harvesting of subscriber billing and device records. At least 13 organizations utilizing a targeted European telecommunications provider have been affected by the campaign.

Recommendation

  • Patch Cisco BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform to version RI.2026.07 or later immediately.
  • Patch Openwave Webtop Media Transcoder to version 1.1.22.0 or later.
  • Prioritize patching by the CISA-mandated deadline of November 24, 2026.
  • Review network access logs for the Cisco OCI-P service for anomalous XML-based requests or unusual outbound traffic indicative of XXE data exfiltration.
]]>criticaladvisory