Full Report
CERT Polska has received a report about 3 vulnerabilities (CVE-2026-35088, CVE-2026-63314 and CVE-2026-63315) found in Slican telephone exchanges.
Analysis Summary
# Vulnerability: Multiple Security Flaws in Slican Telephone Exchanges
## CVE Details
- **CVE ID:** CVE-2026-35088
- **CVSS Score:** Not explicitly provided (Estimated: Medium/High)
- **CWE:** CWE-326 (Inadequate Encryption Strength)
- **CVE ID:** CVE-2026-63314
- **CVSS Score:** Not explicitly provided (Estimated: Medium/High)
- **CWE:** CWE-89 (SQL Injection)
- **CVE ID:** CVE-2026-63315
- **CVSS Score:** Not explicitly provided (Estimated: Low/Medium)
- **CWE:** CWE-256 (Plaintext Storage of a Password)
## Affected Systems
- **Products:** Slican IPx, CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424.
- **Versions:**
- **IPx:** All versions prior to 6.62.0100.
- **CCT-1668, MAC-6400, CXS-0424:** All versions (End-of-Life).
- **Configurations:** Systems utilizing the WebCTI service and those using default TCP/IP symmetric encryption for communication.
## Vulnerability Description
- **CVE-2026-35088 (Hardcoded Cryptographic Key):** Slican exchanges use symmetric encryption for TCP/IP communication where the secret key is hardcoded across multiple binary files. An attacker with access to these binaries can extract the key and decrypt network traffic.
- **CVE-2026-63314 (SQL Injection):** The WebCTI service contains a flaw in the `/webcti/admin_json.php` endpoint. It fails to properly neutralize user-supplied input, allowing an authenticated attacker to execute arbitrary SQL commands against the backend database.
- **CVE-2026-63315 (Plaintext Password Storage):** The WebCTI service stores temporary subscriber passwords in plaintext within the database. If the database is compromised (potentially via CVE-2026-63314), an attacker can obtain these passwords to impersonate subscribers.
## Exploitation
- **Status:** Not reported as exploited in the wild; PoC status not explicitly confirmed, but technical details suggest high reproducibility.
- **Complexity:**
- **CVE-2026-35088:** Medium (Requires binary analysis/access).
- **CVE-2026-63314:** Low (Standard SQLi).
- **CVE-2026-63315:** Low (Post-exploitation/Database access).
- **Attack Vector:**
- **CVE-2026-35088:** Network / Local (Traffic interception).
- **CVE-2026-63314:** Network (Authenticated).
- **CVE-2026-63315:** Network / Local (Database access).
## Impact
- **Confidentiality:** High (Decryption of traffic, database exfiltration, and password theft).
- **Integrity:** Medium (Potential database modification via SQLi).
- **Availability:** Low (Standard SQLi impacts; primary risk is data exposure).
## Remediation
### Patches
- **IPx Series:** Update to version **6.62.0100** or later.
- **EOL Products (CCT-1668, MAC-6400, CXS-0424):** No software-only patch is available. These require a hardware update to support modern software versions.
### Workarounds
- **EOL Devices:** Users are advised to contact the Slican service department to discuss hardware upgrade paths.
- **Network Segmentation:** Place telephone exchanges on a dedicated, isolated VLAN with strict ACLs to prevent unauthorized access to the WebCTI service and to mitigate traffic sniffing.
- **Password Rotation:** Ensure temporary passwords are changed immediately to limit the window for CVE-2026-63315 exploitation.
## Detection
- **Indicators of Compromise:** Monitor for unusual SQL syntax or unexpected database queries originating from the `/webcti/admin_json.php` endpoint.
- **Detection Methods:** Use Web Application Firewalls (WAF) to detect SQL injection patterns. Perform periodic audits of network traffic for the use of known hardcoded keys (if extracted).
## References
- **Vendor Advisory:** Slican Support (Contact directly for EOL hardware updates).
- **CERT Polska Advisory:** hxxps[://]cert[.]pl/en/posts/2026/10/vulnerabilities-in-slican-telephone-exchanges/
- **CVE Records:**
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-35088
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-63314
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-63315