CVE-2026-20320

Katalog CVE

CVSS 7.5 · High EPSS 0,50%

Kerentanan Improper Restriction of XML External Entity Reference. Skor CVSS 3.1 7.5 (High) menurut cisco.com.

Deskripsi (NVD)

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

20 Agustus 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.5 (High), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 40,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt