CVE-2026-35087criticalCWE-288

CVE-2026-35087: critical vulnerability in Slican NCP

Authentication Bypass in Slican telephone exchanges

Published

Follow this CVE+ Monitor IPx+ Monitor CCT-1668

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.7%
Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command. This issue was fixed in versions below: - NCP: version 1.24.0250 - IPx series: version 6.61.0040 - CCT-1668: version 6.56.0430 - MAC-6400: version 6.56.0430 - CXS-0424: version 6.30.0510 The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Slican · CCT-1668Slican · CXS-0424Slican · IPxSlican · MAC-6400Slican · NCP
Related CVEs — Slican NCP

In the same product, most dangerous first.

CVE-2026-35090CRITICALAuthentication Bypass in Slican telephone exchangesEPSS 0.6%CVE-2026-35089HIGHUse of Weak Credentials in Slican telephone exchangesEPSS 0.6%CVE-2026-63315HIGHPlaintext storage of a password in WebCTIEPSS 0.3%CVE-2026-63314HIGHSQL Injection in WebCTIEPSS 0.2%CVE-2026-35088HIGHInadequate Encryption Strength in Slican telephone exchangesEPSS 0.1%