Report an incident
Back
  • About us
  • For experts
Report an incident
About us
About our team Contact
Baza wiedzy
Fałszywe inwestycje Bezpieczne zakupy w internecie (Nie)bezpieczne płatności Fałszywi konsultanci Zadbaj o bezpieczne hasła i logowanie Fałszywe załączniki w mailach Fałszywe prośby o szybki przelew Bezpieczny telefon
Biuletyn OUCH!
Porady bezpieczeństwa OUCH!
Tools
n6 Artemis MWDB
CVD program
CVD policy Advisories

Vulnerabilities in Slican telephone exchanges
15 October 2026 | CERT Polska | #vulnerability, #warning, #cve
CVE ID CVE-2026-35088
Publication date 15 October 2026
Vendor Slican
Product IPx, CCT-1668, MAC-6400, CXS-0424
Vulnerable versions All before 6.62.0100 (IPx)
All (CCT-1668, MAC-6400, CXS-0424)
Vulnerability type (CWE) Inadequate Encryption Strength (CWE-326)
Report source Report to CERT Polska
CVE ID CVE-2026-63314
Publication date 15 October 2026
Vendor Slican
Product IPx
Vulnerable versions All before 6.62.0100
Vulnerability type (CWE) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Report source Report to CERT Polska
CVE ID CVE-2026-63315
Publication date 15 October 2026
Vendor Slican
Product IPx
Vulnerable versions All before 6.62.0100
Vulnerability type (CWE) Plaintext storage of a password (CWE-256)
Report source Report to CERT Polska

Description

CERT Polska has received a report about vulnerabilities in Slican telephone exchanges and participated in coordination of their disclosure.

The vulnerability CVE-2026-35088: Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication.

This issue was fixed in IPx series version 6.62.0100.

The issue still exists in End-Of-Life telephone exchanges:

  • CCT-1668 (CCT1CPU)
  • MAC-6400
  • CXS-0424

These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

The vulnerability CVE-2026-63314: WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.

This issue was fixed in IPx series version 6.62.0100.

The vulnerability CVE-2026-63315: WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.

This issue was fixed in IPx series version 6.62.0100.

Credits

We thank Grupa ŻN for reporting vulnerability CVE-2026-35088. We thank Damian Strojek and Olha Zozulia for reporting vulnerabilities CVE-2026-63314 and CVE-2026-63315.

More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.