Vulnerabilities in Slican telephone exchanges
Vulnerabilities in Slican telephone exchanges
| CVE ID | CVE-2026-35088 |
| Publication date | 15 October 2026 |
| Vendor | Slican |
| Product | IPx, CCT-1668, MAC-6400, CXS-0424 |
| Vulnerable versions | All before 6.62.0100 (IPx) All (CCT-1668, MAC-6400, CXS-0424) |
| Vulnerability type (CWE) | Inadequate Encryption Strength (CWE-326) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-63314 |
| Publication date | 15 October 2026 |
| Vendor | Slican |
| Product | IPx |
| Vulnerable versions | All before 6.62.0100 |
| Vulnerability type (CWE) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-63315 |
| Publication date | 15 October 2026 |
| Vendor | Slican |
| Product | IPx |
| Vulnerable versions | All before 6.62.0100 |
| Vulnerability type (CWE) | Plaintext storage of a password (CWE-256) |
| Report source | Report to CERT Polska |
Description
CERT Polska has received a report about vulnerabilities in Slican telephone exchanges and participated in coordination of their disclosure.
The vulnerability CVE-2026-35088: Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication.
This issue was fixed in IPx series version 6.62.0100.
The issue still exists in End-Of-Life telephone exchanges:
- CCT-1668 (CCT1CPU)
- MAC-6400
- CXS-0424
These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
The vulnerability CVE-2026-63314: WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.
This issue was fixed in IPx series version 6.62.0100.
The vulnerability CVE-2026-63315: WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.
This issue was fixed in IPx series version 6.62.0100.
Credits
We thank Grupa ŻN for reporting vulnerability CVE-2026-35088. We thank Damian Strojek and Olha Zozulia for reporting vulnerabilities CVE-2026-63314 and CVE-2026-63315.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.