The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity vulnerability in Cisco's BroadWorks platform, BleepingComputer reports, with the flaw added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
The listing is significant less for the directive it carries than for what it reveals about where the risk actually sits. BroadWorks is not an application most enterprises install themselves. It is the carrier-side and hosted-service platform that underpins large volumes of business voice, hosted PBX and unified communications services, operated by service providers and delivered downstream as a subscription. The result is an exposure model in which the organisation holding the risk is often not the organisation that can fix it.
Service providers across multiple regions, including Asia-Pacific, resell BroadWorks-based services, so enterprises in any market may be running the platform indirectly through their carrier. In practical terms, that means the standard internal response — inventory the asset, locate the binary, apply the patch — is not available to most affected customers. Their first and most effective move is to contact their service provider and ask, directly, whether their tenant is running a fixed release and on what timeline.
"Actively exploited" status changes the defensive posture for that conversation. Vulnerability disclosures that sit unpatched in a backlog are a governance problem; flaws under confirmed attack are an incident-prevention problem. CISA's KEV inclusion serves as a global triage shortcut even though the Binding Operational Directive behind it formally binds only US federal agencies — it gives defenders outside the federal perimeter an authoritative signal that waiting is no longer the neutral option.
Notably, BroadWorks is a rare entrant to the KEV list, which is dominated by VPN gateways, edge appliances and web platforms. Its appearance signals that unified communications and carrier-grade voice infrastructure are now being targeted with the same intent as perimeter devices, and it exposes a familiar blind spot: patch queues that defer "carrier-side" software because the assumption is someone else owns it.
Reported specifics of the exploitation remain thin. Whether the flaw is being used for initial access, credential theft or lateral movement has not been detailed, and defenders should watch Cisco's own advisory and any observed attack scenarios for follow-up detail. Cisco has made fixed software available; administrators and service providers should be working from the vendor's current advisory rather than secondary summaries.
For enterprise IT teams, the practical checklist is short. Establish whether your organisation consumes BroadWorks-hosted services, at all — including through resold or white-labelled UCaaS and hosted voice arrangements that may not be labelled as such in procurement records. Ask your provider to confirm the patched status of your tenant in writing, along with the date of remediation. Treat an unconfirmed or indefinitely pending answer as urgent rather than routine housekeeping. Where internet-facing portals tied to the platform exist and are under your administrative control, prioritise them accordingly.
The central tension this advisory exposes is unlikely to be unique to one platform: upstream infrastructure flaws propagate downstream invisibly, and patch ownership gets lost in the gap between the carrier and the customer. Until providers communicate remediation status proactively, the burden of asking sits with the enterprise — and a provider's silence should be read as unresolved exposure, not reassurance.
據 BleepingComputer 報道，美國網絡安全及基礎設施安全局（CISA）於周二警告，黑客正利用 Cisco BroadWorks 平台的一個高嚴重性漏洞，該漏洞已列入 CISA 的已被積極利用漏洞（Known Exploited Vulnerabilities，KEV）目錄。
此名單的意義，與其說在於其附帶的指令，不如說在於它揭示了風險實際所在的位置。BroadWorks 並非多數企業自行安裝的應用程式，而是服務供應商（service provider）操作、以下游訂閱形式交付的營運商端（carrier-side）託管服務平台，支撐大量企業語音、託管 PBX 及統一通訊（unified communications）服務。其結果是一種風險錯置的模式：持有風險的機構，往往並非能夠修補漏洞的機構。
包括亞太地區在內，多個地區的服務供應商均轉售基於 BroadWorks 的服務，因此任何市場的企業都可能透過其營運商間接運行該平台。實際而言，這意味著標準的內部應對程序——盤點資產、定位執行檔（binary）、套用補丁——大多數受影響的客戶並不可行。他們最先亦最有效的一步，是聯絡其服務供應商，直接查詢其租戶（tenant）是否正在運行已修復的版本，以及修補的時間表。
「actively exploited」（已被積極利用）的狀態改變了此番交涉的防禦態勢。滯留在待辦清單中未修補的漏洞披露屬治理問題；確認正遭攻擊的漏洞則是事故預防問題。CISA 將其納入 KEV，可視為全球性的分診（triage）捷徑——儘管其背後的 Binding Operational Directive 正式而言僅約束美國聯邦機構——它為聯邦範圍以外的防禦者提供了權威訊號，表明等待已不再是中性的選擇。
值得注意的是，BroadWorks 是 KEV 名單上的少見項目，該名單一向以 VPN 閘道、邊緣設備（edge appliance）及網絡平台為主。它的出現標誌著統一通訊及營運商級語音基礎設施如今正以與邊界（perimeter）設備同樣的意圖成為攻擊目標，同時暴露出一個熟悉的盲點：補丁佇列往往將「carrier-side」軟件擱置，因為假定漏洞由他人負責。
目前有關 exploit 的具體報導仍然有限。該漏洞是否被用於初始存取（initial access）、憑證盜取（credential theft）或橫向移動（lateral movement）尚未詳述，防禦者應留意 Cisco 自身的 advisory 以及任何已觀察到的攻擊場景，以獲取後續細節。Cisco 已提供修復版本；管理員及服務供應商應依據廠商目前的 advisory 行事，而非二手摘要。
對於企業 IT 團隊而言，實務清單很短。首先要確認機構是否根本上有使用 BroadWorks 託管服務——包括透過轉售或白牌（white-labelled）的 UCaaS 及託管語音安排，這類安排在採購記錄中未必如此標示。要求服務供應商以書面確認你的租戶的修補狀態，連同修復日期。將未確認或無限期擱置的答覆視為緊急事項，而非例行維護。凡與該平台相關且由你方管理的對外互聯網入口（internet-facing portal），應相應優先處理。
此 advisory 暴露的核心矛盾不太可能只局限於單一平台：上游基礎設施漏洞會在下游無聲蔓延，而補丁的管轄權往往在營運商與客戶之間的空隙中失落。在服務供應商主動通報修復狀態之前，提出查詢的責任仍落在企業一方——而供應商的沉默應被解讀為尚未解決的風險，而非令人安心的保證。