Read the docs
TI-2026-74686 Aliases CVE-2026-63315

Plaintext storage of a password in Slican IPx WebCTI

Priority LOW 35CWE-256Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-256.

Summary

The WebCTI service for Slican IPx telephone exchanges stores a temporary subscriber password in plaintext, CWE-256. An attacker with access to the database can read the password and log in to the subscriber's account over the network without authentication.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed IPx (Slican): 6.62.0100

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SlicanIPxbefore 6.62.01006.62.0100Patch availableCNA
  • IPx VendorSlican Affected before 6.62.0100 Fixed in 6.62.0100 Patch available CNA

Remediation

Update Slican IPx to version 6.62.0100, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA IPx (Slican) Fixed in 6.62.0100

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Slican IPx 6.62.0100

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-74685 SQL injection in Slican IPx WebCTI lets attackers run SQL commandsPriority LOW 39
    • TI-2026-74684 Weak encryption in Slican telephone exchanges exposes communicationPriority LOW 34
    Show all 3 records →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-63315

References

Advisory 1

Other 1

  • TI-2026-27288 Authentication Bypass in Slican telephone exchanges CVSS 4.0CRITICAL 9.3
  • TI-2025-13318 PHP Function Injection in Slican NPC/IPL/IPM/IPU CVSS 4.0CRITICAL 9.3
  • TI-2026-27289 Use of Weak Credentials in Slican telephone exchanges CVSS 4.0HIGH 8.7
  • TI-2026-27290 Authentication Bypass in Slican telephone exchanges CVSS 4.0CRITICAL 9.3
  • TI-2026-74685 SQL injection in Slican IPx WebCTI lets attackers run SQL commands CVSS 4.0HIGH 8.7
  • TI-2026-74684 Weak encryption in Slican telephone exchanges exposes communication CVSS 4.0HIGH 8.2
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences