[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvSKnBBbefphvBFbpzzGhLhXi3uHlS4Rn8dGIH76nrKw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"684bfc04-fdb3-421c-b229-ab12e37a18a5","unpatched-openwave-and-cisco-broadworks-flaws-actively-exploited-in-targeted-campaigns","fd891e79-94c6-42e0-9974-1facef27ea4d","Unpatched Openwave and Cisco BroadWorks Flaws Actively Exploited in Targeted Campaigns","Threat actors, including a Chinese-speaking group targeting European telecoms, are actively exploiting two unpatched vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks. The Cisco flaw is particularly severe because it requires no authentication — a remote attacker can extract sensitive configuration data via blind XML external entity (XXE) injection without any credentials. The Openwave flaw compounds risk by allowing authenticated users to access files and information beyond their intended scope. These vulnerabilities highlight the danger of delayed patching on internet-facing infrastructure, especially in high-value sectors like telecommunications where nation-state actors actively seek strategic intelligence.","**Immediate actions:**\n- Apply vendor-released patches or mitigations for CVE-2026-111793 (Openwave) and CVE-2026-20320 (Cisco BroadWorks) as an emergency priority.\n- Audit internet-facing instances of both products and restrict external access until patches are confirmed applied.\n- Review logs for signs of blind XXE injection attempts or anomalous file-type conversion activity in affected systems.\n\n**Long-term improvements:**\n- Maintain a continuously updated inventory of all internet-facing software assets to ensure no vulnerable instances go undetected.\n- Establish a risk-tiered emergency patching SLA (e.g., critical\u002Fexploited CVEs patched within 24–72 hours) enforced by policy.\n- Disable or restrict XML external entity processing at the application and WAF level by default across all services.\n\n**Detection measures:**\n- Deploy network-based intrusion detection rules tuned to XXE injection patterns targeting telecom infrastructure.\n- Implement automated vulnerability scanning on a continuous basis for all external-facing systems, with alerting on newly published CVEs matching your asset inventory.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A05:2021 Security Misconfiguration","NIS2 Article 21(2)(e)","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"OWASP A05:2021 Security Misconfiguration":20,"MITRE ATT&CK T1190: Exploit Public-Facing Application":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"This NIS2 provision explicitly requires vulnerability handling and disclosure practices in the acquisition and maintenance of systems — telecom operators subject to NIS2 were obligated to have processes that would have detected and remediated these flaws promptly.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes; timely remediation of CVE-2026-20320 and CVE-2026-111793 would have directly prevented these active exploitations.","The Cisco BroadWorks blind XXE vulnerability is exploitable in part because XML external entity processing is enabled by default, a classic security misconfiguration that OWASP A05 calls out as a critical category to address.","The unauthenticated exploitation of Cisco BroadWorks via XXE injection directly matches this technique, where adversaries exploit vulnerabilities in internet-facing systems to gain initial access or extract sensitive data.","This control requires organizations to continuously assess and remediate vulnerabilities — had a mature vulnerability management program been in place, these actively exploited CVEs would have been prioritized and patched before attackers could leverage them.","published","2026-11-11T10:21:42.750445+00:00","2026-11-11T10:21:42.735+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fthreat-actors-exploit-openwave-cisco-broadworks-vulnerabilities\u002F","threat-actors-exploit-openwave-cisco-broadworks-vulnerabilities-8b1499","Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,51],{"slug":34,"name":46,"problem":47},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":49,"problem":50},"Automated patch management","Known holes get closed in days, not months.",{"slug":52,"name":53,"problem":54},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]