Read the docs
TI-2026-27289 Aliases CVE-2026-35089GHSA-pch2-h8hc-84fh

Use of Weak Credentials in Slican telephone exchanges

Priority MEDIUM 44CWE-1391Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx series: version 6.61.0040 - CCT-1668: version 6.56.0430 - MAC-6400: version 6.56.0430 - CXS-0424: version 6.30.0510 The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00589 48th percentileScored 2026-11-07
Fix Fixed IPx (Slican): 6.61.0040CCT-1668 (Slican): 6.56.0430+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SlicanIPxbefore 6.61.00406.61.0040Patch availableCNA
SlicanCCT-1668before 6.56.04306.56.0430Patch availableCNA
SlicanMAC-6400before 6.56.04306.56.0430Patch availableCNA
SlicanCXS-0424before 6.30.05106.30.0510Patch availableCNA
  • IPx VendorSlican Affected before 6.61.0040 Fixed in 6.61.0040 Patch available CNA
  • CCT-1668 VendorSlican Affected before 6.56.0430 Fixed in 6.56.0430 Patch available CNA
  • MAC-6400 VendorSlican Affected before 6.56.0430 Fixed in 6.56.0430 Patch available CNA
  • CXS-0424 VendorSlican Affected before 6.30.0510 Fixed in 6.30.0510 Patch available CNA

Remediation

  • Fix · CNA IPx (Slican) Fixed in 6.61.0040
  • Fix · CNA CCT-1668 (Slican) Fixed in 6.56.0430
  • Fix · CNA MAC-6400 (Slican) Fixed in 6.56.0430
  • Fix · CNA CXS-0424 (Slican) Fixed in 6.30.0510

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Slican CCT-1668, CXS-0424, MAC-6400 6.30.0510, 6.56.0430

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-27288 Authentication Bypass in Slican telephone exchangesPriority MEDIUM 49
    • TI-2026-27290 Authentication Bypass in Slican telephone exchangesPriority MEDIUM 43
    Show all 3 records →
  • Release ·

    Slican IPx 6.61.0040

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-27288 Authentication Bypass in Slican telephone exchangesPriority MEDIUM 49
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35089
  2. 2026-10-03 Alias added: GHSA-pch2-h8hc-84fh

References

Advisory 1

  • TI-2026-27288 Authentication Bypass in Slican telephone exchanges CVSS 4.0CRITICAL 9.3
  • TI-2025-13318 PHP Function Injection in Slican NPC/IPL/IPM/IPU CVSS 4.0CRITICAL 9.3
  • TI-2026-27290 Authentication Bypass in Slican telephone exchanges CVSS 4.0CRITICAL 9.3
  • TI-2026-74685 SQL injection in Slican IPx WebCTI lets attackers run SQL commands CVSS 4.0HIGH 8.7
  • TI-2026-74686 Plaintext storage of a password in Slican IPx WebCTI CVSS 4.0HIGH 8.2
  • TI-2026-74684 Weak encryption in Slican telephone exchanges exposes communication CVSS 4.0HIGH 8.2
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences