Cisco BroadWorks CVE-2025-23019 Actively Exploited: Urgent Detection and Remediation Guide for Service Providers

---
title: Cisco BroadWorks Web Process Spawning Shell or System Commands
id: 5a2b8f3e-7c1d-4e9a-b6c5-9d8f2a1b3c4d
status: experimental
description: Detects the BroadWorks web server or application server process spawning a shell interpreter or system utility, indicative of CVE-2025-23019 command injection.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-cmd-inj-2025-01
  - https://www.cisa.gov/news-events/alerts/2026/01/21/cisa-adds-cisco-broadworks-vulnerability-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/01/22
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/apache'
      - '/nginx'
      - '/bwdaemon'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/netcat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate BroadWorks maintenance scripts or automated health checks. Baseline known-good parent/child relationships in your environment.
level: critical
---
title: BroadWorks Service Account Executing Credential Access or Reconnaissance Commands
id: 8c4d6e2f-9a1b-4c5d-8e7f-2a3b4c5d6e7f
status: experimental
description: Detects the BroadWorks service account (bwadmin, bwcli, or bwuser) executing commands consistent with post-exploitation activity following CVE-2025-23019 compromise.
references:
  - https://attack.mitre.org/techniques/T1003/
  - https://attack.mitre.org/techniques/T1087/
author: Security Arsenal
date: 2026/01/22
tags:
  - attack.credential_access
  - attack.t1003
  - attack.discovery
  - attack.t1087
logsource:
  category: process_creation
  product: linux
detection:
  selection_user:
    User|contains:
      - 'bwadmin'
      - 'bwcli'
      - 'bwuser'
  selection_cmd:
    CommandLine|contains:
      - '/etc/passwd'
      - '/etc/shadow'
      - 'cat /root/.ssh/authorized_keys'
      - 'find / -name "*.pem"'
      - 'grep -r "password" /usr/local/broadworks/'
      - 'ip route'
      - 'netstat -tulpn'
  condition: selection_user and selection_cmd
falsepositives:
  - BroadWorks administrators performing routine maintenance. Filter by source IP and correlate with change windows.
level: high
---
title: Cisco BroadWorks Exploitation Attempt - URI and Command Injection Pattern
id: 3e7f9a1c-5b2d-4e8f-9c6a-1b2d3e4f5a6b
status: experimental
description: Detects HTTP requests to BroadWorks administrative interfaces containing shell metacharacters or common command injection payloads associated with CVE-2025-23019.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/22
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri|contains:
      - '/bw/'
      - '/admin/'
      - '/cli/'
      - '/webservice/'
  selection_payload:
    cs-uri|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
      - '$('
      - '%3B'
      - '%7C'
      - '%26%26'
  condition: selection_uri and selection_payload
falsepositives:
  - Unlikely in standard BroadWorks API usage. Legitimate parameters should not contain shell metacharacters. Investigate all matches.
level: high

// Hunt for potential Cisco BroadWorks CVE-2025-23019 exploitation and post-exploitation activity in Microsoft Sentinel
// Table: DeviceProcessEvents (requires MDE on Linux or Syslog ingestion) 
// Focus on BroadWorks service account spawning unexpected child processes and accessing sensitive files
let BroadWorksAccounts = dynamic(["bwadmin", "bwcli", "bwuser", "broadworks"]);
let SuspiciousCommands = dynamic(["/bin/bash", "/bin/sh", "curl", "wget", "nc", "python", "perl", "/etc/passwd", "/etc/shadow", "netstat", "ss -tulpn"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessAccountName in~ (BroadWorksAccounts) or ProcessAccountName in~ (BroadWorksAccounts)
| where FileName in~ (SuspiciousCommands) or ProcessCommandLine has_any (SuspiciousCommands)
| where not (ProcessCommandLine has_any ("healthcheck", "backup", "maintenance", "bwcleanup")) // Tune exclusions to your environment
| extend SuspiciousChild = iff(InitiatingProcessFileName =~ "java" and FileName in~ ("bash", "sh", "python", "perl"), true, false)
| where SuspiciousChild == true or ProcessCommandLine has_any ("/etc/", "authorized_keys", "find /", "grep -r")
| summarize 
    ExecutionCount = count(), 
    UniqueCommands = make_set(ProcessCommandLine), 
    FirstSeen = min(TimeGenerated), 
    LastSeen = max(TimeGenerated) 
    by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName
| extend Severity = iff(ExecutionCount > 5 or UniqueCommands has_any ("/etc/shadow", "authorized_keys"), "High", "Medium")
| sort by FirstSeen desc;
// Additional query for network connections from BroadWorks hosts to rare external IPs
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("broadworks", "bw-app", "voip-core") // Adjust to your asset naming convention
| where RemoteIPType == "Public"
| where not (RemoteUrl has_any ("cisco.com", "redhat.com", "oracle.com")) // Tune for known-good destinations
| summarize ConnectionCount = count(), UniquePorts = make_set(RemotePort) by DeviceName, RemoteIP, RemoteUrl
| where ConnectionCount > 10
| sort by ConnectionCount desc;

-- Hunt for anomalous child processes spawned by BroadWorks Java/Apache services and suspicious file access
-- Target: CVE-2025-23019 post-exploitation behavior on Linux BroadWorks hosts
SELECT 
    Pid, 
    Name, 
    CommandLine, 
    Exe, 
    Username, 
    CreateTime,
    Ppid,
    pslist(Pid=Ppid).Name AS ParentName,
    pslist(Pid=Ppid).CommandLine AS ParentCommandLine
FROM pslist()
WHERE 
    (
        -- Java or Apache spawning shells or scripting engines (command injection indicator)
        (ParentName =~ 'java|apache|nginx' AND Name =~ 'bash|sh|python|perl|ruby')
        OR 
        -- BroadWorks service accounts running reconnaissance or credential access commands
        (Username =~ 'bwadmin|bwcli|bwuser' AND CommandLine =~ '/etc/passwd|/etc/shadow|authorized_keys|find /|grep -r|netstat|ss -tulpn|ip route')
        OR
        -- Direct execution of common post-exploitation tools from BroadWorks directories
        (Exe =~ '/usr/local/broadworks/.*(bash|sh|python|perl)')
    )
    AND NOT CommandLine =~ 'healthcheck|backup|maintenance|bwcleanup' -- Tune exclusions

#!/bin/bash
# Cisco BroadWorks CVE-2025-23019 Remediation and Verification Script
# Tested on RHEL 8/9 and Oracle Linux 8/9. Run as root or via sudo.
# This script checks for vulnerable versions, applies vendor-recommended mitigations, and hunts for IOCs.

set -euo pipefail
LOG_FILE="/var/log/broadworks_cve_2025_23019_remediation.log"
echo "[$(date)] Starting CVE-2025-23019 Remediation Check" | tee -a "$LOG_FILE"

# 1. Identify BroadWorks version
BW_VERSION_FILE="/usr/local/broadworks/bw_base/conf/version.txt"
if [[ -f "$BW_VERSION_FILE" ]]; then
    BW_VERSION=$(grep -i "version" "$BW_VERSION_FILE" | head -1)
    echo "[+] Detected BroadWorks Version: $BW_VERSION" | tee -a "$LOG_FILE"
else
    echo "[!] BroadWorks version file not found at $BW_VERSION_FILE. Is BroadWorks installed?" | tee -a "$LOG_FILE"
fi

# 2. Check if patched (Fixed versions per Cisco advisory: 2023.12.1.1085, 2024.01.1.396, 2024.06.1.148, 2024.10.1.45 or later)
# This is a simplified check; validate against your specific release train.
FIXED_PATTERN="2023\.12\.1\.1085|2024\.01\.1\.396|2024\.06\.1\.148|2024\.10\.1\.45|2025\."
if [[ -n "${BW_VERSION:-}" && "$BW_VERSION" =~ $FIXED_PATTERN ]]; then
    echo "[+] BroadWorks appears to be running a fixed version. Verify against Cisco advisory." | tee -a "$LOG_FILE"
else
    echo "[!] WARNING: BroadWorks version is potentially vulnerable to CVE-2025-23019." | tee -a "$LOG_FILE"
    echo "[!] IMMEDIATE ACTION REQUIRED: Apply the emergency patch from Cisco PSIRT." | tee -a "$LOG_FILE"
fi

# 3. Hunt for IOCs: Unauthorized SSH keys
if [[ -f /root/.ssh/authorized_keys ]]; then
    echo "[+] Checking /root/.ssh/authorized_keys for unauthorized entries..." | tee -a "$LOG_FILE"
    grep -v "^#" /root/.ssh/authorized_keys | while read -r key; do
        # In a real environment, compare against a known-good whitelist
        echo "[?] Found SSH key: $key" | tee -a "$LOG_FILE"
    done
    echo "[!] Manually verify all keys in /root/.ssh/authorized_keys are authorized." | tee -a "$LOG_FILE"
fi

# 4. Hunt for suspicious cron jobs and systemd timers
echo "[+] Checking for suspicious cron entries..." | tee -a "$LOG_FILE"
crontab -l 2>/dev/null | grep -v "^#" | grep -E "curl|wget|bash|sh|python|perl" && echo "[!] Suspicious cron job found" | tee -a "$LOG_FILE" || echo "[+] No obvious malicious cron jobs detected." | tee -a "$LOG_FILE"

for user in bwadmin bwcli bwuser; do
    if crontab -u "$user" -l 2>/dev/null | grep -v "^#" | grep -qE "curl|wget|bash|sh|python|perl"; then
        echo "[!] Suspicious cron job found for user $user" | tee -a "$LOG_FILE"
    fi
done

# 5. Hunt for suspicious network connections
echo "[+] Checking for established connections to uncommon external IPs..." | tee -a "$LOG_FILE"
ss -tulpn | grep -E ":443|:8443" | awk '{print $5, $6, $7}' | sort -u | while read -r line; do
    echo "[?] Listener: $line" | tee -a "$LOG_FILE"
done

# 6. Temporary mitigation: Restrict access to admin interface if patch cannot be applied immediately
echo "[+] Applying temporary iptables mitigation to restrict BroadWorks admin interface to trusted management IPs..." | tee -a "$LOG_FILE"
# REPLACE with your actual management subnets
MANAGEMENT_SUBNETS=("10.0.0.0/8" "192.168.0.0/16" "172.16.0.0/12")
for subnet in "${MANAGEMENT_SUBNETS[@]}"; do
    iptables -C INPUT -p tcp -s "$subnet" --dport 443 -j ACCEPT 2>/dev/null || iptables -A INPUT -p tcp -s "$subnet" --dport 443 -j ACCEPT
    iptables -C INPUT -p tcp -s "$subnet" --dport 8443 -j ACCEPT 2>/dev/null || iptables -A INPUT -p tcp -s "$subnet" --dport 8443 -j ACCEPT
done
# Drop all other traffic to admin ports (uncomment after whitelisting verified)
# iptables -A INPUT -p tcp --dport 443 -j DROP
# iptables -A INPUT -p tcp --dport 8443 -j DROP
iptables-save > /etc/sysconfig/iptables
echo "[+] iptables rules applied. Verify connectivity before enforcing DROP rules." | tee -a "$LOG_FILE"

echo "[$(date)] Remediation check complete. Review $LOG_FILE for findings." | tee -a "$LOG_FILE"
echo "[!] CRITICAL: Apply the official Cisco patch immediately. This script is a temporary mitigation and detection aid only."