If your organization still runs legacy VoIP gear, two names belong on your patch radar right now: Cisco BroadWorks and OpenWave-class endpoints. Recent advisories confirm that several flaws in these systems are not theoretical — they are being actively exploited in the wild.
Why it matters: VoIP systems sit on the same network as your data. A flaw in a call manager or an endpoint can give an attacker a foothold, a way to eavesdrop on calls, or a path to move laterally.
What to do first:
- Check your exact software and firmware versions against the vendor advisories.
- Patch in a staging environment before touching production — call-flow testing matters.
- If you cannot patch yet, segment VoIP traffic onto its own VLAN and restrict management interfaces to trusted jump hosts.
- Turn on SIP over TLS and SRTP where supported; disable plain-text signaling.
- Watch logs for odd registration patterns and repeated failed logins.
I published a longer technical breakdown of the vulnerabilities, the architecture, and the remediation steps here: Cisco BroadWorks and OpenWave Flaws Actively Exploited: A Deep Dive
Disclosure: this post was drafted with AI assistance and reviewed by a human.
Top comments (0)