# Slican Telephone Exchanges: Hardcoded Encryption Key (CVE-2026-35088) and WebCTI SQL Injection / Plaintext Password Storage (CVE-2026-63314, CVE-2026-63315)

> CERT Polska disclosed that Slican telephone exchanges encrypt TCP/IP communication with a symmetric key hardcoded in multiple binaries (CVE-2026-35088, CWE-326, CVSS v4.0 8.2), and that the IPx WebCTI service has an authenticated SQL injection in /webcti/admin_json.php (CVE-2026-63314, CWE-89, CVSS v4.0 8.7) and stores a temporary subscriber password in plaintext (CVE-2026-63315, CWE-256, CVSS v4.0 8.2). IPx is fixed in 6.62.0100; the end-of-life CCT-1668, MAC-6400 and CXS-0424 remain unfixed.

- **Published:** 2026-10-16T03:18:36Z
- **Last reviewed:** 2026-10-16T03:18:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3700
- **ID:** TL-2026-3700
- **Severity:** HIGH (CVSS 8.7)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35088, CVE-2026-63314, CVE-2026-63315

## Description

On 2026-10-15 CERT Polska, acting as CVE coordinator (CNA), published an advisory covering three vulnerabilities in Slican telephone exchange (PBX) products. The CVE records were published to NVD at 09:17 UTC the same day and last modified at about 14:17 UTC.

CVE-2026-35088 (CWE-326, Inadequate Encryption Strength): Slican telephone exchanges use symmetric encryption for TCP/IP communication, and the secret key is hardcoded in multiple binary files. NVD describes the impact as attackers with access to the binaries being able to intercept and decrypt TCP/IP communications. The CNA-assigned CVSS v4.0 score is 8.2 HIGH (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N), and the SSVC assessment lists exploitation as none with partial technical impact. Affected: Slican IPx before 6.62.0100 (fixed), CCT-1668 up to 6.56.0430, MAC-6400 up to 6.56.0430, and CXS-0424 up to 6.30.0510. These three models were discontinued in 2011-2012 and no software fix is offered; obtaining a fix requires replacing the hardware, and the vendor directs customers to its service department.

CVE-2026-63314 (CWE-89, SQL Injection): the WebCTI service of Slican IPx has improper neutralization of input in the /webcti/admin_json.php endpoint that allows an authenticated attacker to execute SQL injection attacks. CVSS v4.0 8.7 HIGH (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N): network reachable, low privileges, no user interaction, high confidentiality and integrity impact. Fixed in IPx 6.62.0100.

CVE-2026-63315 (CWE-256, Plaintext Storage of a Password): the WebCTI service stores a temporary subscriber password in plaintext. Per the CVE description, an attacker with access to the database can obtain the user's password and log in to the subscriber's account. CVSS v4.0 8.2 HIGH (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). Fixed in IPx 6.62.0100. The two WebCTI flaws chain naturally: SQL injection in the admin_json endpoint could expose database contents, including plaintext temporary subscriber passwords, though the sources do not state that this chain was demonstrated.

The advisory reports no exploitation, no public PoC and no IOCs; the SSVC entry for CVE-2026-35088 lists exploitation as none. Defenders should treat attack details beyond the advisory as unverified. Credits: Grupa ZN (CVE-2026-35088); Damian Strojek and Olha Zozulia (CVE-2026-63314, CVE-2026-63315). Third-party aggregators indicate that CERT Polska earlier (2026-05-27) published other Slican exchange CVEs (CVE-2026-35087 administrative protocol authentication bypass, CVE-2026-35089 predictable secure key generation, CVE-2026-35090 unauthenticated remote control-panel management); those are not part of this record but show continuing research interest in this product line. A BeaconBeagle domain search for slican.pl returned no C2 matches.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials
- T1040 Network Sniffing
- T1005 Data from Local System

## Sources

- [CERT Polska: Slican telephone exchange vulnerabilities (CVE-2026-35088, CVE-2026-63314, CVE-2026-63315)](https://cert.pl/en/posts/2026/10/CVE-2026-35088/)
- [NVD: CVE-2026-35088](https://nvd.nist.gov/vuln/detail/CVE-2026-35088)
- [NVD: CVE-2026-63314](https://nvd.nist.gov/vuln/detail/CVE-2026-63314)
- [NVD: CVE-2026-63315](https://nvd.nist.gov/vuln/detail/CVE-2026-63315)
- [Slican WebCTI for subscribers (vendor product page)](https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/)
- [CERT Polska Coordinated Vulnerability Disclosure Policy](https://cert.pl/en/cvd/)
- [CVE.report: Slican CCT-1668 known vulnerabilities](https://cve.report/software/Slican/CCT-1668)
- [SOCRadar IOC Radar: Vulnerabilities in Slican telephone exchanges software](https://socradar.io/free-tools/ioc-radar/reports/vulnerabilities-in-slican-telephone-exchanges-software-6f63e82f810c)
- [CWE-326: Inadequate Encryption Strength](https://cwe.mitre.org/data/definitions/326.html)
- [CWE-89: SQL Injection](https://cwe.mitre.org/data/definitions/89.html)
- [CWE-256: Plaintext Storage of a Password](https://cwe.mitre.org/data/definitions/256.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3700