Description

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T17:18:40.433Z",
  "pubdate": "2026-08-19T17:18:40.433Z",
  "executiveSummary": "An XML External Entity (XXE) injection vulnerability exists in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks, specifically within the Open Client Interface - Provisioning (OCI-P) service. This security flaw enables an unauthenticated, remote attacker to read arbitrary sensitive configuration files from the underlying filesystem. The root cause of the vulnerability stems from the improper configuration of the XML parser, which permits external entity resolution by default. Successful exploitation of this vulnerability grants the attacker the ability to view sensitive system files operating under the security context and privileges of the Cisco BroadWorks application user. The risk implications are severe, as unauthorized disclosure of configuration data can expose credentials, internal network architecture, and system secrets, facilitating further compromise of the affected infrastructure. Exploitation requires no prior authentication and can be executed remotely over the network by transmitting a maliciously crafted XML message payload to the targeted OCI-P service endpoint.",
  "technicalDetails": "The vulnerability resides within the Open Client Interface (OCI) XML Parser component of Cisco BroadWorks, which handles incoming XML-formatted messages processed by the Open Client Interface - Provisioning (OCI-P) service. The fundamental root cause is the failure to explicitly disable external entity resolution during the initialization and configuration of the XML parsing engine. Because external entity resolution is allowed by default, the underlying parser evaluates and processes XML External Entity (XXE) definitions embedded within incoming XML documents.\nThe attack flow proceeds as follows: An unauthenticated, remote attacker initiates a network connection to the exposed OCI-P service. The attacker crafts a malicious XML payload containing a Document Type Definition (DTD) declaration that defines an external entity pointing to a sensitive file path on the target filesystem (e.g., system configuration files or local resource identifiers). Upon submission, the vulnerable OCI-P service passes the crafted XML message to the OCI XML Parser. The parser processes the document, encounters the malicious external entity reference, and subsequently attempts to resolve it by reading the targeted file from the local filesystem.\nIf the file exists and the process possesses the requisite filesystem permissions, the parser retrieves the contents of the file. Depending on the construction of the XXE payload, the retrieved data may be reflected back to the attacker within the application response, or utilized in out-of-band data exfiltration channels.\nThe vulnerable component is the OCI XML Parser utilized by the Open Client Interface - Provisioning (OCI-P) service in Cisco BroadWorks. Network exposure is remote, as the OCI-P service listens for incoming client connections over the network. Authentication requirements are nonexistent, allowing unauthenticated attackers to trigger the flaw. Privilege requirements for exploitation are minimal from the perspective of the network boundary, but the post-exploitation impact is bound by the privileges of the Cisco BroadWorks operating user, allowing access to any file readable by that user account on the filesystem."
}