Authentication Bypass in Slican telephone exchanges

published 2026-05-27 5 mo ago modified 2026-10-26 14 d ago also EUVD-2026-32276

cvss: 9.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits: 0; none known

Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command.

This issue was fixed in versions below: - NCP: version 1.24.0250 - IPx series: version 6.61.0040 - CCT-1668: version 6.56.0430 - MAC-6400: version 6.56.0430 - CXS-0424: version 6.30.0510

The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

Patch / fix

fixed in 5

Slican IPx 6.61.0040
Slican CCT-1668 6.56.0430
Slican MAC-6400 6.56.0430
Slican CXS-0424 6.30.0510
Slican NCP 1.24.0250

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 5 mo ago (2026-05-27)

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Slican IPx
Slican CCT-1668
Slican MAC-6400
Slican CXS-0424
Slican NCP

Classification

Weakness

CWE-288 Authentication Bypass Using an Alternate Path or Channel

References

cert.pl /posts/2026/05/CVE-2026-35087
third-party-advisory

Sources

CVE List CVE-2026-35087
NVD CVE-2026-35087

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary