Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
Threat actors exploit Openwave and Cisco BroadWorks vulnerabilities to leak sensitive information.
Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder (CVE-2026-111793) and Cisco BroadWorks (CVE-2026-20320). The Openwave flaw allows authenticated users to convert unintended file types and obtain sensitive information, while the Cisco vulnerability enables unauthenticated remote attackers to read sensitive configuration data via blind XML external entity injection. A Chinese-speaking threat actor is reportedly using the Cisco vulnerability in a broad campaign targeting a European telecommunications provider.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cisco?
Get an email when a new story names Cisco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors, including a Chinese-speaking group targeting European telecoms, are actively exploiting two unpatched vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks. The Cisco flaw is particularly severe because it requires no authentication — a remote attacker can extract sensitive configuration data via blind XML external entity (XXE) injection without any credentials. The Openwave flaw compounds risk by allowing authenticated users to access files and information beyond their intended scope. These vulnerabilities highlight the danger of delayed patching on internet-facing infrastructure, especially in high-value sectors like telecommunications where nation-state actors actively seek strategic intelligence.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-111793
- cve — CVE-2026-20320