Critical Security Bug Opens Cisco BroadWorks to Complete Takeover

A critical security vulnerability in Cisco’s BroadWorks unified collaboration and messaging platform could pave the way for complete takeover of the platform, and the theft of a raft of sensitive data.

BroadWorks is an all-in-one unified communications as a service (UCaaS) platform that includes VoIP calling, instant messaging, video calling, WebEx integration, and more. It’s one of Cisco’s flagship offerings and enjoys dominant market share, with millions of business seats signed up across enterprises and small and midsize businesses (SMBs) alike.

The bug (CVE-2023-20238), which exists in some implementations of the BroadWorks Application Delivery Platform and the BroadWorks Xtended Services Platform specifically, carries a 10 out of 10 on the CVSS vulnerability-severity scale.

According to an official advisory, cyberattackers wielding a valid BroadWorks user ID can exploit the platform’s single sign-on (SSO) implementation to authenticate as an existing user. From there, they could hijack communications, snoop on sensitive communications, send fraudulent messages, phish info from other internal users, make phone calls for toll fraud purposes, cause denial-of-service (DoS), and more.

“This vulnerability is due to the method used to validate SSO tokens,” according to the networking giant. “A successful exploit could allow the attacker to [take actions at the] privilege level of the forged account … If that account is an administrator account, the attacker would have the ability to view confidential information, modify customer settings, or modify settings for other users.”

Cisco has patched CVE-2023-20238 in AP.platform.23.0.1075.ap385341 and in the 2023.06_1.333 and 2023.07_1.332 release independent versions.