| CVE ID | CVE-2026-35087 |
| Publication date | 27 May 2026 |
| Vendor | Slican |
| Product | IPx, CCT-1668, MAC-6400, CXS-0424, NCP |
| Vulnerable versions | All before 6.61.0040 (IPx) All before 6.56.0430 (CCT-1668, MAC-6400) All before 6.30.0510 (CXS-0424) All before 1.24.0250 (NCP) |
| Vulnerability type (CWE) | Authentication Bypass Using an Alternate Path or Channel (CWE-288) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-35089 |
| Publication date | 27 May 2026 |
| Vendor | Slican |
| Product | IPx, CCT-1668, MAC-6400, CXS-0424 |
| Vulnerable versions | All before 6.61.0040 (IPx) All before 6.56.0430 (CCT-1668, MAC-6400) All before 6.30.0510 (CXS-0424) |
| Vulnerability type (CWE) | Use of Weak Credentials (CWE-1391) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-35090 |
| Publication date | 27 May 2026 |
| Vendor | Slican |
| Product | IPL-256, IPM-032, CCT-1668, MAC-6400, CXS-0424 |
| Vulnerable versions | All before 6.61.0040 (IPL-256, IPM-032) All before 6.56.0430 (CCT-1668, MAC-6400) All before 6.30.0510 (CXS-0424) |
| Vulnerability type (CWE) | Authentication Bypass Using an Alternate Path or Channel (CWE-288) |
| Report source | Report to CERT Polska |
Description
CERT Polska has received a report about vulnerabilities in Slican telephone exchanges software and participated in coordination of their disclosure.
The vulnerability CVE-2026-35087: Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command.
The vulnerability CVE-2026-35089: In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials.
The vulnerability CVE-2026-35090: In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a specific caller ID. This allows them to bypass admin authentication and gain full access to the service protocol and configuration panel. This vulnerability is independent of the telephone exchanges configuration. If remote access is disabled, calling with this caller ID will temporarily enable it.
These issues were fixed in versions below:
- NCP: version 1.24.0250
- IPx series: version 6.61.0040
- CCT-1668: version 6.56.0430
- MAC-6400: version 6.56.0430
- CXS-0424: version 6.30.0510
These issues still exist in End-Of-Life telephone exchanges in versions 4.xx and below:
- CCT-1668 (CCT1CPU)
- MAC-6400
- CXS-0424
These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
Credits
We thank Grupa ŻN for the responsible vulnerability report.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.