Unpatched Openwave and Cisco BroadWorks Flaws Actively Exploited in Targeted Campaigns
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors, including a Chinese-speaking group targeting European telecoms, are actively exploiting two unpatched vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks. The Cisco flaw is particularly severe because it requires no authentication — a remote attacker can extract sensitive configuration data via blind XML external entity (XXE) injection without any credentials. The Openwave flaw compounds risk by allowing authenticated users to access files and information beyond their intended scope. These vulnerabilities highlight the danger of delayed patching on internet-facing infrastructure, especially in high-value sectors like telecommunications where nation-state actors actively seek strategic intelligence.
Tactical Insight
Immediate actions
- Apply vendor-released patches or mitigations for CVE-2026-111793 (Openwave) and CVE-2026-20320 (Cisco BroadWorks) as an emergency priority.
- Audit internet-facing instances of both products and restrict external access until patches are confirmed applied.
- Review logs for signs of blind XXE injection attempts or anomalous file-type conversion activity in affected systems.
Long-term improvements
- Maintain a continuously updated inventory of all internet-facing software assets to ensure no vulnerable instances go undetected.
- Establish a risk-tiered emergency patching SLA (e.g., critical/exploited CVEs patched within 24–72 hours) enforced by policy.
- Disable or restrict XML external entity processing at the application and WAF level by default across all services.
Detection measures
- Deploy network-based intrusion detection rules tuned to XXE injection patterns targeting telecom infrastructure.
- Implement automated vulnerability scanning on a continuous basis for all external-facing systems, with alerting on newly published CVEs matching your asset inventory.