Read the docs
TI-2026-27288 Aliases CVE-2026-35087GHSA-74x7-73gr-c646

Authentication Bypass in Slican telephone exchanges

Priority MEDIUM 49CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command. This issue was fixed in versions below: - NCP: version 1.24.0250 - IPx series: version 6.61.0040 - CCT-1668: version 6.56.0430 - MAC-6400: version 6.56.0430 - CXS-0424: version 6.30.0510 The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00662 51st percentileScored 2026-11-07
Fix Fixed IPx (Slican): 6.61.0040CCT-1668 (Slican): 6.56.0430+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SlicanIPxbefore 6.61.00406.61.0040Patch availableCNA
SlicanCCT-1668before 6.56.04306.56.0430Patch availableCNA
SlicanMAC-6400before 6.56.04306.56.0430Patch availableCNA
SlicanCXS-0424before 6.30.05106.30.0510Patch availableCNA
SlicanNCPbefore 1.24.02501.24.0250Patch availableCNA
  • IPx VendorSlican Affected before 6.61.0040 Fixed in 6.61.0040 Patch available CNA
  • CCT-1668 VendorSlican Affected before 6.56.0430 Fixed in 6.56.0430 Patch available CNA
  • MAC-6400 VendorSlican Affected before 6.56.0430 Fixed in 6.56.0430 Patch available CNA
  • CXS-0424 VendorSlican Affected before 6.30.0510 Fixed in 6.30.0510 Patch available CNA
  • NCP VendorSlican Affected before 1.24.0250 Fixed in 1.24.0250 Patch available CNA

Remediation

  • Fix · CNA IPx (Slican) Fixed in 6.61.0040
  • Fix · CNA CCT-1668 (Slican) Fixed in 6.56.0430
  • Fix · CNA MAC-6400 (Slican) Fixed in 6.56.0430
  • Fix · CNA CXS-0424 (Slican) Fixed in 6.30.0510
  • Fix · CNA NCP (Slican) Fixed in 1.24.0250

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Slican CCT-1668, CXS-0424, MAC-6400 6.30.0510, 6.56.0430

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-27289 Use of Weak Credentials in Slican telephone exchangesPriority MEDIUM 44
    • TI-2026-27290 Authentication Bypass in Slican telephone exchangesPriority MEDIUM 43
    Show all 3 records →
  • Release ·

    Slican IPx 6.61.0040

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-27289 Use of Weak Credentials in Slican telephone exchangesPriority MEDIUM 44
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35087
  2. 2026-10-03 Alias added: GHSA-74x7-73gr-c646
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2025-13318 PHP Function Injection in Slican NPC/IPL/IPM/IPU CVSS 4.0CRITICAL 9.3
  • TI-2026-27289 Use of Weak Credentials in Slican telephone exchanges CVSS 4.0HIGH 8.7
  • TI-2026-27290 Authentication Bypass in Slican telephone exchanges CVSS 4.0CRITICAL 9.3
  • TI-2026-74685 SQL injection in Slican IPx WebCTI lets attackers run SQL commands CVSS 4.0HIGH 8.7
  • TI-2026-74686 Plaintext storage of a password in Slican IPx WebCTI CVSS 4.0HIGH 8.2
  • TI-2026-74684 Weak encryption in Slican telephone exchanges exposes communication CVSS 4.0HIGH 8.2
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences