Threat reportVulnerabilityTL-2026-3700
Slican Telephone Exchanges: Hardcoded Encryption Key (CVE-2026-35088) and WebCTI SQL Injection / Plaintext Password Storage (CVE-2026-63314, CVE-2026-63315)
Slican Telephone Exchanges (TL-2026-3700) is a high-severity software vulnerability scored CVSS 8.7, first published 2026-10-16. It has no confirmed attribution, affects Slican IPx, references 3 CVEs (CVE-2026-35088, CVE-2026-63314, CVE-2026-63315), maps to 6 MITRE ATT&CK techniques (T1005, T1040, T1078), and is covered by 9 detection rules and 17 indicators of compromise.
- CVSS
- 8.7/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-3700
- Threat ID
- TL-2026-3700
- Severity
- HIGH
- CVSS
- 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, enterprise, government administration, health
- Target regions
- Europe
- Detection rules
- 9
- Indicators of compromise
- 17
How Slican Telephone Exchanges works
CERT Polska disclosed that Slican telephone exchanges encrypt TCP/IP communication with a symmetric key hardcoded in multiple binaries (CVE-2026-35088, CWE-326, CVSS v4.0 8.2), and that the IPx WebCTI service has an authenticated SQL injection in /webcti/admin_json.php (CVE-2026-63314, CWE-89, CVSS v4.0 8.7) and stores a temporary subscriber password in plaintext (CVE-2026-63315, CWE-256, CVSS v4.0 8.2). IPx is fixed in 6.62.0100; the end-of-life CCT-1668, MAC-6400 and CXS-0424 remain unfixed.
On 2026-10-15 CERT Polska, acting as CVE coordinator (CNA), published an advisory covering three vulnerabilities in Slican telephone exchange (PBX) products. The CVE records were published to NVD at 09:17 UTC the same day and last modified at about 14:17 UTC.
CVE-2026-35088 (CWE-326, Inadequate Encryption Strength): Slican telephone exchanges use symmetric encryption for TCP/IP communication, and the secret key is hardcoded in multiple binary files. NVD describes the impact as attackers with access to the binaries being able to intercept and decrypt TCP/IP communications. The CNA-assigned CVSS v4.0 score is 8.2 HIGH (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N), and the SSVC assessment lists exploitation as none with partial technical impact. Affected: Slican IPx before 6.62.0100 (fixed), CCT-1668 up to 6.56.0430, MAC-6400 up to 6.56.0430, and CXS-0424 up to 6.30.0510. These three models were discontinued in 2011-2012 and no software fix is offered; obtaining a fix requires replacing the hardware, and the vendor directs customers to its service department.
CVE-2026-63314 (CWE-89, SQL Injection): the WebCTI service of Slican IPx has improper neutralization of input in the /webcti/admin_json.php endpoint that allows an authenticated attacker to execute SQL injection attacks. CVSS v4.0 8.7 HIGH (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N): network reachable, low privileges, no user interaction, high confidentiality and integrity impact. Fixed in IPx 6.62.0100.
CVE-2026-63315 (CWE-256, Plaintext Storage of a Password): the WebCTI service stores a temporary subscriber password in plaintext. Per the CVE description, an attacker with access to the database can obtain the user's password and log in to the subscriber's account. CVSS v4.0 8.2 HIGH (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). Fixed in IPx 6.62.0100. The two WebCTI flaws chain naturally: SQL injection in the admin_json endpoint could expose database contents, including plaintext temporary subscriber passwords, though the sources do not state that this chain was demonstrated.
The advisory reports no exploitation, no public PoC and no IOCs; the SSVC entry for CVE-2026-35088 lists exploitation as none. Defenders should treat attack details beyond the advisory as unverified. Credits: Grupa ZN (CVE-2026-35088); Damian Strojek and Olha Zozulia (CVE-2026-63314, CVE-2026-63315). Third-party aggregators indicate that CERT Polska earlier (2026-05-27) published other Slican exchange CVEs (CVE-2026-35087 administrative protocol authentication bypass, CVE-2026-35089 predictable secure key generation, CVE-2026-35090 unauthenticated remote control-panel management); those are not part of this record but show continuing research interest in this product line. A BeaconBeagle domain search for slican.pl returned no C2 matches.
MITRE ATT&CK techniques used in TL-2026-3700
Collection
Credential Access
T1040 Network Sniffing; T1212 Exploitation for Credential Access; T1552 Unsecured Credentials
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Affected products and versions in Slican Telephone Exchanges
- Slican — IPx
Vulnerable versions: all versions before 6.62.0100
Fixed in: 6.62.0100 - Slican — CCT-1668
Vulnerable versions: up to and including 6.56.0430 (end of life) - Slican — MAC-6400
Vulnerable versions: up to and including 6.56.0430 (end of life) - Slican — CXS-0424
Vulnerable versions: up to and including 6.30.0510 (end of life)
Remediation for Slican Telephone Exchanges
Patches
- Upgrade Slican IPx to version 6.62.0100 or later
Immediate actions
- Restrict network access to Slican exchange TCP/IP service ports and the WebCTI web interface to trusted management networks only
- Do not expose WebCTI (/webcti/) or exchange control ports to the internet
- Review WebCTI accounts and rotate temporary subscriber passwords
Workarounds
- For unpatched or discontinued models, contact the Slican service department for upgrade options
- Place a WAF or reverse proxy in front of WebCTI and restrict access to /webcti/admin_json.php
Longer-term hardening
- Replace discontinued CCT-1668, MAC-6400 and CXS-0424 exchanges (no fix available for CVE-2026-35088)
- Segment telephony infrastructure from user and server networks
- Monitor web server logs for anomalous requests to /webcti/admin_json.php
CVEs associated with Slican Telephone Exchanges
Weaknesses (CWE) in Slican Telephone Exchanges
Timeline of Slican Telephone Exchanges
- CCT-1668, MAC-6400 and CXS-0424 exchanges discontinued during 2011-2012 (exact date not given; January 2011 used as the period start); they never receive a fix for CVE-2026-35088
- Per third-party aggregators, earlier Slican exchange CVEs (CVE-2026-35087, CVE-2026-35089, CVE-2026-35090) were published; not part of this record, shown for context
- Credits issued: Grupa ZN (CVE-2026-35088); Damian Strojek and Olha Zozulia (CVE-2026-63314, CVE-2026-63315)
- SSVC v2.0.3 entry for CVE-2026-35088 rates exploitation as none with partial technical impact; NVD records modified at about 14:17 UTC
- CCT-1668, MAC-6400 (up to 6.56.0430) and CXS-0424 (up to 6.30.0510) remain unfixed for CVE-2026-35088; vendor directs customers to its service department
- Slican IPx 6.62.0100 fixes all three vulnerabilities (CVE-2026-35088, CVE-2026-63314, CVE-2026-63315)
- CVE-2026-35088, CVE-2026-63314 and CVE-2026-63315 records published to NVD at 09:17 UTC with CNA CVSS v4.0 scores of 8.2, 8.7 and 8.2
- CERT Polska publishes the advisory covering CVE-2026-35088, CVE-2026-63314 and CVE-2026-63315 in Slican telephone exchanges
Sources cited for Slican Telephone Exchanges
- CERT Polska: Slican telephone exchange vulnerabilities (CVE-2026-35088, CVE-2026-63314, CVE-2026-63315)
- NVD: CVE-2026-35088
- NVD: CVE-2026-63314
- NVD: CVE-2026-63315
- Slican WebCTI for subscribers (vendor product page)
- CERT Polska Coordinated Vulnerability Disclosure Policy
- CVE.report: Slican CCT-1668 known vulnerabilities
- SOCRadar IOC Radar: Vulnerabilities in Slican telephone exchanges software
- CWE-326: Inadequate Encryption Strength
- CWE-89: SQL Injection
- CWE-256: Plaintext Storage of a Password
Detection coverage for TL-2026-3700
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3700 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.