Read the docs
TI-2026-27290 Aliases CVE-2026-35090GHSA-4fcp-hv44-rggc

Authentication Bypass in Slican telephone exchanges

Priority MEDIUM 43CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a specific caller ID. This allows them to bypass admin authentication and gain full access to the service protocol and configuration panel. This vulnerability is independent of the telephone exchanges configuration. If remote access is disabled, calling with this caller ID will temporarily enable it. This issue was fixed in versions below: - IPL-256: version 6.61.0040 - IPM-032: version 6.61.0040 - CCT-1668: version 6.56.0430 - MAC-6400: version 6.56.0430 - CXS-0424: version 6.30.0510 The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00625 50th percentileScored 2026-11-07
Fix Fixed CCT-1668 (Slican): 6.56.0430MAC-6400 (Slican): 6.56.0430+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SlicanCCT-1668before 6.56.04306.56.0430Patch availableCNA
SlicanMAC-6400before 6.56.04306.56.0430Patch availableCNA
SlicanCXS-0424before 6.30.05106.30.0510Patch availableCNA
SlicanIPL-256before 6.61.00406.61.0040Patch availableCNA
SlicanIPM-032before 6.61.00406.61.0040Patch availableCNA
  • CCT-1668 VendorSlican Affected before 6.56.0430 Fixed in 6.56.0430 Patch available CNA
  • MAC-6400 VendorSlican Affected before 6.56.0430 Fixed in 6.56.0430 Patch available CNA
  • CXS-0424 VendorSlican Affected before 6.30.0510 Fixed in 6.30.0510 Patch available CNA
  • IPL-256 VendorSlican Affected before 6.61.0040 Fixed in 6.61.0040 Patch available CNA
  • IPM-032 VendorSlican Affected before 6.61.0040 Fixed in 6.61.0040 Patch available CNA

Remediation

  • Fix · CNA CCT-1668 (Slican) Fixed in 6.56.0430
  • Fix · CNA MAC-6400 (Slican) Fixed in 6.56.0430
  • Fix · CNA CXS-0424 (Slican) Fixed in 6.30.0510
  • Fix · CNA IPL-256 (Slican) Fixed in 6.61.0040
  • Fix · CNA IPM-032 (Slican) Fixed in 6.61.0040

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Slican CCT-1668, CXS-0424, MAC-6400 6.30.0510, 6.56.0430

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-27288 Authentication Bypass in Slican telephone exchangesPriority MEDIUM 49
    • TI-2026-27289 Use of Weak Credentials in Slican telephone exchangesPriority MEDIUM 44
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35090
  2. 2026-10-03 Alias added: GHSA-4fcp-hv44-rggc
  3. 2026-10-31 EPSS moved to the 50th–90th percentile
  4. 2026-11-01 EPSS moved to the below the 50th percentile
  5. 2026-11-03 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2026-27288 Authentication Bypass in Slican telephone exchanges CVSS 4.0CRITICAL 9.3
  • TI-2025-13318 PHP Function Injection in Slican NPC/IPL/IPM/IPU CVSS 4.0CRITICAL 9.3
  • TI-2026-27289 Use of Weak Credentials in Slican telephone exchanges CVSS 4.0HIGH 8.7
  • TI-2026-74685 SQL injection in Slican IPx WebCTI lets attackers run SQL commands CVSS 4.0HIGH 8.7
  • TI-2026-74686 Plaintext storage of a password in Slican IPx WebCTI CVSS 4.0HIGH 8.2
  • TI-2026-74684 Weak encryption in Slican telephone exchanges exposes communication CVSS 4.0HIGH 8.2
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences