CVE-2026-20320 is a high-severity vulnerability. A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco allows an unauthenticated, remote attacker to read sensitive configuration information on an affected system.

This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

This vulnerability affects Cisco Systems that have vulnerable OCI-P (Open Client Interface-Provisioning) XML Parser enabled. The vulnerability is caused by improper handling of XML External Entities (XXE) within the XML parser.

This vulnerability does not require valid user credentials. An attacker only needs network access to the OCI-P service on a vulnerable Cisco BroadWorks system.

Step 1 - Identify a Reachable BroadWorks Server

The attacker identifies a Cisco BroadWorks server that exposes the OCI-P service and is reachable from the internet or another accessible network.

Step 2 - Send a Crafted XML Request

The attacker sends a specially crafted XML request containing malicious external entity references to the OCI-P service.

Step 3 - XML External Entity Processing

Due to improper XML parser configuration, the server processes the external entity references and retrieves local files or resources specified by the attacker.

Step 4 - Access Sensitive Information

The attacker can obtain sensitive information stored on the affected server, including configuration files and other accessible system files.

CERTVU recommends the following:

1. Upgrade Immediately

   Install the security updates provided by Cisco and upgrade affected Cisco BroadWorks systems to a fixed release: Application Delivery Platform - RI.2026.07, Application Server - RI.2026.07, Profile Server - RI.2026.07, Xtended Services Platform - RI.2026.07.

2. Restrict Network Access

   Prevent direct internet access to management interfaces and allow access only from trusted management networks and authorized IP addresses.

3. Disable Unnecessary XML Features

   Place control components behind firewalls and enforce strict access-control policies for management interfaces.

4. Harden Server Security

   Apply the principle of least privilege, restrict file permissions, regularly review system configuration and ensure servers are patched and secured.