cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Attackers Exploit Openwave and Cisco BroadWorks Vulnerabilities

· Original article ↗

Summary

Threat actors are exploiting flaws in Openwave Webtop Media Transcoder and Cisco BroadWorks. CISA added both to its KEV catalog and urged federal agencies to patch by November 24.

Key points

  • CVE-2026-111793 affects Openwave Webtop Media Transcoder: administrator-defined file-type restrictions are not enforced, potentially letting authenticated users convert unintended document types.
  • Openwave says version 1.1.22.0 contains a patch. Japan JVN flagged the flaw as exploited and warned that a crafted file upload could expose sensitive information.
  • CVE-2026-20320 is a remotely exploitable, unauthenticated XXE flaw in Cisco BroadWorks that could expose sensitive configuration information through the OCI-P service.
  • Cisco included fixes in version RI.2026.07 of BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform.
  • Malbear Labs reported that a Chinese-speaking threat actor exploited the Cisco flaw in a campaign using an autonomous AI intrusion harness against a European telecommunications provider and its customers; at least 13 organizations using the provider’s services may have been targeted.
  • The reported campaign focused on asset enumeration, credential theft, and harvesting subscriber billing and device records.
  • CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on November 10 and urged federal agencies to patch by November 24.

Article Details

Vulnerability Types
  • Failure to enforce administrator-defined file-type restrictions, allowing unintended document types to be processed and converted
  • Blind XML external entity (XXE) injection caused by external entity resolution being allowed by default
Severity
Unknown
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe reported campaigns exploited vulnerabilities in Webtop Media Transcoder and Cisco BroadWorks, including a remotely exploitable Cisco BroadWorks flaw, to access sensitive information.

CVE

CVE-2026-111793Openwave Messaging (Ireland) Limited · Webtop Media TranscoderThe Webtop Media Transcoder bug, tracked as CVE-2026-111793, exists because administrator-defined file-type restrictions are not enforced, allowing users to convert unintended file types.CVE-2026-20320Cisco · Cisco BroadWorksThe Cisco BroadWorks vulnerability, tracked as CVE-2026-20320, was disclosed on August 19 as an out-of-band blind XML external entity injection that could be exploited remotely, without authentication, to read sensitive

Vendors

CiscoThreat actors are exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information.Openwave MessagingOpenwave Messaging provides email and messaging platforms, including webmail, to communication service providers.

Products

Cisco BroadWorksThreat actors are exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information.Webtop Media TranscoderThreat actors are exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information.

Industries

Telecommunicationsin a broad campaign that relied on an autonomous AI intrusion harness to target a European telecommunications provider and its customers.

Related Articles