CVE-2026-35087criticalCWE-288

CVE-2026-35087: falha crítica em Slican NCP

Authentication Bypass in Slican telephone exchanges

Publicada em

Seguir esta CVE+ Monitorar IPx+ Monitorar CCT-1668

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.7%
Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command. This issue was fixed in versions below: - NCP: version 1.24.0250 - IPx series: version 6.61.0040 - CCT-1668: version 6.56.0430 - MAC-6400: version 6.56.0430 - CXS-0424: version 6.30.0510 The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Slican · CCT-1668Slican · CXS-0424Slican · IPxSlican · MAC-6400Slican · NCP
CVEs relacionadas — Slican NCP

No mesmo produto, das mais perigosas para as menos.

CVE-2026-35090CRITICALAuthentication Bypass in Slican telephone exchangesEPSS 0.6%CVE-2026-35089HIGHUse of Weak Credentials in Slican telephone exchangesEPSS 0.6%CVE-2026-63315HIGHPlaintext storage of a password in WebCTIEPSS 0.3%CVE-2026-63314HIGHSQL Injection in WebCTIEPSS 0.2%CVE-2026-35088HIGHInadequate Encryption Strength in Slican telephone exchangesEPSS 0.1%