TI-2026-74684 Aliases CVE-2026-35088

Weak encryption in Slican telephone exchanges exposes communication

LOW 34CWE-326Published 2026-10-15 · Updated 2026-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-326.

Summary

Slican telephone exchanges use symmetric encryption for TCP/IP communication, and the secret key is hardcoded in multiple binary files (CWE-326). An attacker who can access these files can decrypt the communication. Affected are Slican IPx before 6.62.0100, CCT-1668 and MAC-6400 through 6.56.0430, and CXS-0424 through 6.30.0510.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication. This issue was fixed in IPx series version 6.62.0100. The issue STILL EXISTS in End-Of-Life telephone exchanges: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00117 1st percentileScored 2026-11-07

Fix Fixed IPx (Slican): 6.62.0100

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Slican	IPx	before 6.62.0100	6.62.0100	Patch available	CNA
Slican	CCT-1668	up to 6.56.0430	—	No fix listed	CNA
Slican	MAC-6400	up to 6.56.0430	—	No fix listed	CNA
Slican	CXS-0424	up to 6.30.0510	—	No fix listed	CNA

IPx VendorSlican Affected before 6.62.0100 Fixed in 6.62.0100 Patch available CNA
CCT-1668 VendorSlican Affected up to 6.56.0430 Fixed in — No fix listed CNA
MAC-6400 VendorSlican Affected up to 6.56.0430 Fixed in — No fix listed CNA
CXS-0424 VendorSlican Affected up to 6.30.0510 Fixed in — No fix listed CNA

Remediation

Slican fixed IPx in version 6.62.0100. The sources list no fixed version for CCT-1668, MAC-6400 or CXS-0424.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA IPx (Slican) Fixed in 6.62.0100

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-15
Slican IPx 6.62.0100
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-74685 SQL injection in Slican IPx WebCTI lets attackers run SQL commandsPriority LOW 39
- TI-2026-74686 Plaintext storage of a password in Slican IPx WebCTIPriority LOW 35
Show all 3 records →

Timeline

2026-10-16 Threatist record created from CVE-2026-35088

References

Advisory 1

https://cert.pl/posts/2026/10/CVE-2026-35088

TI-2026-27288 Authentication Bypass in Slican telephone exchanges CVSS 4.0CRITICAL 9.3
TI-2025-13318 PHP Function Injection in Slican NPC/IPL/IPM/IPU CVSS 4.0CRITICAL 9.3
TI-2026-27289 Use of Weak Credentials in Slican telephone exchanges CVSS 4.0HIGH 8.7
TI-2026-27290 Authentication Bypass in Slican telephone exchanges CVSS 4.0CRITICAL 9.3
TI-2026-74685 SQL injection in Slican IPx WebCTI lets attackers run SQL commands CVSS 4.0HIGH 8.7
TI-2026-74686 Plaintext storage of a password in Slican IPx WebCTI CVSS 4.0HIGH 8.2

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences