CVE-2026-20320

Executive Summary

CVE-2026-20320 is an XML External Entity (XXE) injection vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks, rated CVSS 7.5 (High). An unauthenticated, remote attacker can exploit this flaw by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service, allowing them to read sensitive configuration files and other data from the filesystem with the privileges of the Cisco BroadWorks user. The vulnerability stems from external entity resolution being enabled by default in the XML parser, a classic CWE-611 misconfiguration. At the time of this report, no official patch is available, and the vulnerability remains unpatched across affected deployments.

Technical Analysis

Vulnerability Class and Root Cause

CVE-2026-20320 falls under CWE-611: Improper Restriction of XML External Entity Reference, commonly known as XXE (XML External Entity Injection). The root cause is that the OCI XML Parser in Cisco BroadWorks allows external entity resolution by default. When the parser encounters an XML document containing an external entity declaration (e.g., <!ENTITY xxe SYSTEM "file:///etc/passwd">), it resolves that entity by fetching the referenced resource, which may be a local filesystem file accessible with the privileges of the BroadWorks process.

The specific flaw is in how XML entries are parsed: the parser does not disable external entity resolution, and it does not validate or restrict the destinations of these external references. This is a textbook insecure-default configuration issue rather than a memory corruption or logical flaw — the parser behaves as designed natively, but that design choice is unsafe for untrusted input.

Attack Surface

The attack surface is the Open Client Interface – Provisioning (OCI-P) service. OCI-P is a provisioning interface in Cisco BroadWorks that accepts XML-based messages for subscriber and service configuration. The service is network-accessible, and because the vulnerability can be exploited by an unauthenticated attacker (per CVSS PR:N — no privileges required), any host that can reach the OCI-P service can deliver a malicious payload.

CVSS Breakdown (derived from vector)

• Attack Vector: Network (AV:N) — remotely exploitable over the network.
• Attack Complexity: Low (AC:L) — no special conditions required; exploitation is straightforward.
• Privileges Required: None (PR:N) — no authentication needed.
• User Interaction: None (UI:N) — no victim interaction required.
• Scope: Unchanged (S:U) — the compromise is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) — full disclosure of sensitive files; the attacker can read configuration files.
• Integrity Impact: None (I:N) — no data modification.
• Availability Impact: None (A:N) — no denial-of-service component.

The C:H component is significant: configuration files on BroadWorks systems often contain credentials, database connection strings, SSO keys, and infrastructure topology details that can pivot into deeper compromise.

Technical Detail Level

The NVD description does not provide specific function names, code snippets, or parser internals beyond the component identification (OCI XML Parser, OCI-P service). No specific file paths that are readable, no specific payload structure, and no specific endpoint URL are given. The analysis above is therefore provided at the vulnerability-class and attack-mechanism level, consistent with the available data. Insufficient technical detail is available to map the exact code path within the parser.

Exploitation Scenarios

Prerequisites and Assumptions

No public PoC is available for this vulnerability, and no exploit code has been observed in the wild. The attack chain described below is inferred from the XXE vulnerability class and the OCI-P service description, consistent with the NVD text.

Step 1: Reconnaissance / Target Identification

An attacker first needs to identify Cisco BroadWorks deployments and locate the OCI-P service. This is typically done via:

• Shodan/Censys searches for BroadWorks-related banners or the OCI-P port (the specific port is not disclosed in the NVD data).
• Network scanning within perimeter networks for known BroadWorks management interfaces.
• Bulk scanning of IP ranges for responses indicative of BroadWorks (e.g., XML service banners or unusual HTTP responses on provisioning ports).

The attacker does not need authentication, so they only need network reachability to the OCI-P listener.

Step 2: Triggering the Flaw

The attacker crafts an XML message designed to exploit the external entity resolution behavior. A classic XXE payload at the class level would include a document type definition (DTD) with an external entity declaration referencing a local file:

<?xml version="1.0"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///path/to/sensitive/file"> ]>
<request>&xxe;</request>

The payload is sent to the OCI-P service as an XML message. Because the parser resolves external entities by default, the entity reference &xxe; is replaced with the contents of the target file, and that content is either returned in the response or logged/processed in a way the attacker can observe.

Step 3: Payload Execution at the Class Level

The vulnerability class is XXE, so the "execution" is not code execution but rather server-side file disclosure. The attacker:

• References a local file using the file:// URI scheme (protocol-level detail common to all XXE).
• May attempt to use other URI schemes (e.g., http://) for SSRF (Server-Side Request Forgery) to probe internal network resources, though such impact is not confirmed in the NVD data and should not be assumed.
• Must iterate over candidate file paths to locate sensitive configuration files (the NVD description does not specify which files are interesting, but configuration files are the stated target).

The parser processes the XML and, because external entities are enabled, fetches the referenced file with the privileges of the Cisco BroadWorks user (likely a service account with broad filesystem read access).

Step 4: Post-Exploitation Impact

A successful exploit allows the attacker to view sensitive files from the filesystem. The concrete business impact depends on what those files contain, but typical BroadWorks configuration files include:

• Database credentials (host, username, password).
• LDAP/AD bind credentials.
• TLS/SSL private keys and certificates.
• API tokens and shared secrets used for interservice communication.
• Server topology and network configuration details.

The attacker has read access with the privileges of the BroadWorks user, meaning the disclosure is limited to files that this OS-level account can read. This is a confidentiality-only breach (C:H / I:N / A:N).

Note on Current Exploit Status

No public PoC exists, no Nuclei template is available, and no exploit code has been observed in the wild. The attack chain is inferred from the vulnerability class and is accurate at the class level, but specific implementation details (exact XML structure expected by OCI-P, exact file paths exposed) require hands-on validation that has not been published.

Impact Assessment

Business Impact

The confidentiality impact is High (C:H). Reading sensitive configuration files from Cisco BroadWorks represents a serious data exposure because these systems are core telephony and unified-communications infrastructure for carriers and large enterprises. Disclosure of:

• Database credentials enables lateral movement into backend systems.
• TLS keys undermines the integrity/confidentiality of encrypted communications for the affected service.
• Provisioning secrets can allow the attacker to manipulate subscriber configurations in subsequent attacks (though this specific CVE only grants read access, not write).

The attack requires zero privileges and is network-exploitable, making it attractive to both external attackers and low-privilege insiders looking to escalate their knowledge of the environment.

Affected Systems

The affected component is the OCI-P (Open Client Interface – Provisioning) service in Cisco BroadWorks. Because the affected versions list is empty (Affected Versions: []) and no patch is available, it must be assumed that all currently deployed versions of Cisco BroadWorks that expose the OCI-P service are potentially vulnerable until a patch is released or the service is hardened.

Blast Radius

The blast radius is confined to the filesystem of the BroadWorks host (read-only), but the downstream implications extend to any system whose credentials or configuration information is stored in files readable by the BroadWorks service account. In a typical deployment, this account runs with sufficient privileges to access core configuration, making the effective blast radius broad across the telephony infrastructure.

CVSS Context

The CVSS score is 7.5 (High). The attack is trivial (Network, Low Complexity, No Privileges, No User Interaction), but the technical impact is limited to confidentiality. The Scope is Unchanged, meaning the compromised component (the parser) does not cross a trust boundary that would let an attacker directly impact other system components. However, the data read from the parser can enable further attacks, a factor not captured in the CVSS unchanged scope.

Detection Guidance

The following detection rules are written to detect XXE-style attacks against the OCI-P service. Because the specific OCI-P transport format is not disclosed in the NVD data, the rules target the XML-level indicators common to all XXE attacks and the network/authentication anomalies that accompany exploitation.

Sigma Rule

title: Potential XXE Exploitation Against Cisco BroadWorks OCI-P
id: 5f8a4c2e-7b29-4f8e-9c3d-1a6e2f5b8c0d
status: experimental
description: Detects XML messages sent to Cisco BroadWorks OCI-P containing external entity declarations, which may indicate CVE-2026-20320 exploitation attempts.
author: vartersit.com Threat Intel
date: 2026/05/15
logsource:
  category: application
  product: cisco_broadworks
  service: oci-p
detection:
  selection_doctype:
    - message|contains: '<!DOCTYPE'
  selection_entity:
    - message|contains|all:
        - '<!ENTITY'
        - 'SYSTEM'
    - message|contains|all:
        - '<!ENTITY'
        - 'PUBLIC'
  selection_external_ref:
    - message|contains: 'file://'
    - message|contains: 'http://'
    - message|contains: 'https://'
  selection_proto:
    - protocol: 'xml'
  condition: selection_doctype and selection_proto and (selection_entity or selection_external_ref)
  timeframe: 5m
falsepositives:
  - Legitimate XML provisioning messages that use externally defined schemas (rare but possible)
fields:
  - src_ip
  - dst_port
  - message
level: high

YARA Rule

rule CVE_2026_20320_XXE_OCI_P_Payload
{
    meta:
        author = "vartersit.com Threat Intel"
        description = "Detects XML payloads targeting Cisco BroadWorks OCI-P XXE vulnerability (CVE-2026-20320)"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20320"
        score = 75

    strings:
        $doctype = "<!DOCTYPE" ascii nocase
        $entity = "<!ENTITY" ascii nocase
        $system  = "SYSTEM" ascii nocase
        $public  = "PUBLIC" ascii nocase
        $file_scheme = "file://" ascii nocase
        $http_scheme = "http://" ascii nocase
        $oci_ref = "OCI-P" ascii nocase wide

    condition:
        uint16(0) == 0x3C3F // "<?"
        and $doctype
        and $entity
        and ($system or $public)
        and ($file_scheme or $http_scheme)
        and (filesize < 100KB)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"ET EXPLOIT Cisco BroadWorks OCI-P XXE Attempt (CVE-2026-20320)"; flow:to_server,established; content:"<!DOCTYPE"; nocase; content:"<!ENTITY"; distance:0; nocase; content:"SYSTEM"; distance:0; nocase; content:"file://"; distance:0; nocase; reference:cve,2026-20320; classtype:attempted-information-leak; sid:203201; rev:1;)

Note: This rule assumes the OCI-P payload is transmitted in cleartext or is visible after TLS decryption. If the service uses TLS, network-level detection requires TLS interception or the rule should be applied to the decrypted payload stream.

Elastic Detection

// Detection rule: XXE payloads against BroadWorks OCI-P
// Look for XML entity declarations in messages to known BroadWorks ports
any where
  // XML document start
  process.message : "<?xml*" or http.request.body.content : "<?xml*" or
  // Generic: any message containing both DOCTYPE and ENTITY with SYSTEM/PUBLIC
  (process.message : "*<!DOCTYPE*<!ENTITY*SYSTEM*" or
   process.message : "*<!DOCTYPE*<!ENTITY*PUBLIC*") or
  (http.request.body.content : "*<!DOCTYPE*<!ENTITY*SYSTEM*" or
   http.request.body.content : "*<!DOCTYPE*<!ENTITY*PUBLIC*")

Splunk SPL Query

index=* (sourcetype=*cisco*broadworks* OR sourcetype=*oci*p* OR sourcetype=*xml*)
  AND (message="*<!DOCTYPE*" OR xml_data="*<!DOCTYPE*")
  AND (message="*<!ENTITY*SYSTEM*" OR xml_data="*<!ENTITY*SYSTEM*"
       OR message="*<!ENTITY*PUBLIC*" OR xml_data="*<!ENTITY*PUBLIC*")
  AND (message="*file://*" OR xml_data="*file://*")
| table _time, src_ip, dest_ip, dest_port, message
| sort - _time

Wazuh OSSEC Rule

<group name="cisco,broadworks,xxe,">
  <rule id="203201" level="12">
    <decoded_as>xml</decoded_as>
    <match>OCI-P</match>
    <match>OCI_P</match>
    <regex><!DOCTYPE.*<!ENTITY.*SYSTEM|<!DOCTYPE.*<!ENTITY.*PUBLIC</regex>
    <description>Cisco BroadWorks OCI-P: XXE payload detected (CVE-2026-20320) - external entity reference found</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exploit,information_disclosure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (confidence 0/4). No patch evidence is available from any tracked source. No vendor fix or workaround has been published.

1. Immediate Mitigations (while unpatched)

• Restrict network access to OCI-P: Apply strict access control lists (ACLs) so the OCI-P service is only reachable from trusted provisioning networks and management hosts. Block direct Internet exposure.
• Disable external entity resolution: If Cisco BroadWorks allows parser configuration (e.g., via service parameters, JVM/parser flags, or XML parser settings), disable external entity resolution and DTD processing entirely. This directly addresses the root cause per the NVD description ("external entity resolution being allowed by default").
• Network segmentation: Isolate BroadWorks components from the general corporate network and from any zone where untrusted traffic is present.
• Monitor OCI-P traffic: Deploy the Suricata/Sigma rules above on inspection points that can see traffic to the OCI-P service (including after TLS decryption, if applicable).
• Assume compromise of data reachable by the service account: If exploitation is suspected, audit file access logs and treat all credentials and keys in files readable by the BroadWorks user as potentially exposed.

2. Patch / Upgrade Steps

• Monitor Cisco advisory channels: Watch for a Cisco Security Advisory (SA) specific to this CVE. Apply the vendor-recommended update or hotfix as soon as it is released.
• Check for configuration bundles: Cisco may release a configuration change or parser hardening guide rather than a full software patch, given that the root cause is a default configuration. Apply any recommended configuration hardening immediately.
• Version tracking: Because Affected Versions is empty, assume all versions are affected until a fixed version or confirmation of non-affected versions is published.

3. Long-Term Hardening

• Adopt a "deny by default" XML parsing policy: Ensure any XML parser in the environment — BroadWorks or otherwise — has external entities, DTDs, and XInclude disabled unless there is a specific, documented business need.
• Input validation: Implement an XML message schema validation layer in front of OCI-P (e.g., via an API gateway or WAF) that rejects documents containing DOCTYPE declarations.
• Least-privilege service accounts: Reduce the filesystem privileges of the Cisco BroadWorks user account to only those files/directories strictly required for operation. This limits the confidentiality impact if a similar flaw is exploited in the future.
• Credential hygiene: Rotate any credentials that would be disclosed by this vulnerability (database, LDAP, internal service tokens) on a regular basis, and avoid storing secrets in plaintext-readable configuration files.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-20320 — Official NVD record with the description, CVSS vector, and CWE classification.
2. CWE-611 Reference: https://cwe.mitre.org/data/definitions/611.html — MITRE CWE entry detailing the XML External Entity vulnerability class and typical remediation.
3. Cisco Security Advisories Portal: https://sec.cloudapps.cisco.com/security/center/publicationListing — Monitor for the pending advisory for CVE-2026-20320 (no advisory published at the time of writing).
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-20320 is not listed; no exploitation in the wild has been confirmed.
5. FIRST.org CVSS Calculator: https://www.first.org/cvss/calculator/3.1 — For verification of the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (score 7.5).

Threat Actor / Exploit-in-the-Wild Status

No known threat actor campaigns have been attributed to this CVE. No exploitation-in-the-wild evidence exists per CISA KEV status (NO). No public exploit code or PoC has been released. The EPSS score has not been calculated by FIRST.org yet, indicating very recent disclosure or low PREM risk assessment as of the reporting date. Organizations should nonetheless prioritize remediation given the trivial attack complexity and the sensitive nature of the data exposed.