Slican fixes three flaws in IPx phone exchanges; old models stay exposed

Slican fixes three flaws in IPx phone exchanges; old models stay exposed

15 October 2026: CERT Polska has disclosed three high-severity flaws in telephone exchanges made by Slican, the PBX maker based in Bydgoszcz. The worst lets anyone holding copies of the exchange's program files decrypt its network traffic, because the encryption key is written into them. IPx exchanges are fixed in version 6.62.0100. Three older models, discontinued in 2011 and 2012, will not be fixed at all.

Not yet independently verified. We found no statement or release note from Slican itself on these flaws or on version 6.62.0100; the details come from CERT Polska, which coordinated the disclosure, and the CVE records it filed. We will update this when it can be confirmed, and remove this note.

CERT Polska coordinated the disclosure and published the advisory on 15 October, the same day the CVE records went live.

The three flaws and their scores

• CVE-2026-35088, inadequate encryption strength, CVSS 4.0 score 8.2. Slican exchanges protect TCP/IP communication with symmetric encryption whose secret key is hardcoded in several binary files. Affects IPx before 6.62.0100 and all versions of CCT-1668, MAC-6400 and CXS-0424.
• CVE-2026-63314, SQL injection in the WebCTI service of IPx exchanges, at /webcti/admin_json.php, CVSS 4.0 score 8.7. An attacker needs to be signed in.
• CVE-2026-63315, plaintext storage of a temporary subscriber password in WebCTI, CVSS 4.0 score 8.2. Anyone who reaches the database can read the password and log in as that subscriber.

The last two are also fixed in IPx 6.62.0100. CERT Polska credits Grupa ŻN with the key finding and Damian Strojek and Olha Zozulia with the WebCTI flaws. Neither CERT Polska nor the CVE records report exploitation.

Exchanges that will not be patched

For the CCT-1668, MAC-6400 and CXS-0424, the advisory says the products "require a hardware update in order to receive a software update". Slican recommends that owners contact its service department to discuss upgrade options. An exchange bought more than a decade ago and still running therefore has a known, public way to read its traffic and no fix short of new hardware.

Limiting exposure until the hardware changes

The three flaws need different footholds. Reading traffic with the hardcoded key requires both the program files and a position on the network path, so exchanges whose management and CTI traffic stays on a segregated network are harder to reach. The WebCTI flaws need a route to that service and, for the SQL injection, a valid account, so restricting who can reach WebCTI and reviewing its accounts reduces the risk on IPx units that cannot be updated at once. None of this changes the advice for the three old models, which is replacement.

Our VoIP software category lists 15 products, our telephony software category 11 and our cloud PBX category eight, for organisations weighing a hosted replacement.

Company profile on TrustList: Slican

Related on TrustList:

• Takeovers with dates from the exchanges: Tribal votes on 2 October, Gamma on 20 October, SYSTEX tender runs to 5 November
• FreePBX publishes four security advisories on 29 September 2026: update the Pinsets, Sangoma Connect, SIPSTATION and Contact Manager modules

Sources

• CERT Polska: Vulnerabilities in Slican telephone exchanges, 15 October 2026
• CVE Program: CVE-2026-35088 record (CNA CERT-PL), 15 October 2026