Cisco Webex for BroadWorks Flaw Could Expose User Credentials

Cisco has disclosed a vulnerability in Webex for BroadWorks that could let attackers intercept user credentials and data in certain setups. The issue, tracked as CSCwo20742, affects Release 45.2 on Windows. Cisco released configuration fixes and recommends restarting affected systems.

Cisco Webex for BroadWorks Flaw

The vulnerability comes from insecure SIP transport settings, which expose user credentials in authentication headers during client-server communication.

SIP, used for voice and video calls, sends metadata in plaintext if not encrypted. In affected setups, attackers could intercept these credentials through man-in-the-middle attacks.

Additionally, authenticated users with access to logs could see credentials stored in plaintext. This double risk makes credential theft more likely, especially in hybrid or on-premises Windows deployments. Cisco hasn’t seen attacks yet but warns that the flaw is easy to exploit and requires no special privileges.

Affected Systems and Mitigation Strategies

The vulnerability affects only Cisco Webex for BroadWorks Release 45.2 on Windows servers, with hybrid deployments also at risk. Linux and macOS environments are not affected.

Cisco has pushed configuration updates to secure SIP protocols, but admins must restart applications for them to take effect. If the patch can’t be applied right away, Cisco advises manually configuring SIP to use encryption protocols to prevent header interception.

Administrators should also ensure compatibility with existing telephony systems.

Cisco recommends rotating credentials for all user accounts tied to Webex for BroadWorks to prevent breaches from prior exposures. This issue highlights risks in legacy communication protocols like SIP, which lack modern encryption.

Analysts report that 32% of enterprise VoIP systems still use unencrypted SIP trunks. Cisco’s quick patch deployment underscores the growing pressure to address vulnerabilities in hybrid work tools, which are vital for businesses post-pandemic. The rise in VoIP-related vulnerabilities in 2024 stresses the need for stronger security in enterprise communications.