CVE-2025-14577: Slican Devices PHP Injection RCE Flaw

CVE-2025-14577 Overview

CVE-2025-14577 is a critical PHP Function Injection vulnerability affecting Slican NCP/IPL/IPM/IPU telecommunication devices. An unauthenticated remote attacker can execute arbitrary PHP commands by sending specially crafted requests to the /webcti/session_ajax.php endpoint. This vulnerability allows complete compromise of affected devices without requiring any authentication credentials.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on vulnerable Slican telephony devices, potentially compromising enterprise communication infrastructure and enabling lateral movement within corporate networks.

Affected Products

• Slican NCP devices (versions prior to 1.24.0190)
• Slican IPL devices (versions prior to 6.61.0010)
• Slican IPM devices (versions prior to 6.61.0010)
• Slican IPU devices (versions prior to 6.61.0010)

Discovery Timeline

• 2026-02-24 - CVE CVE-2025-14577 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-14577

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), indicating that a critical function within the Slican device web interface lacks proper authentication controls. The /webcti/session_ajax.php endpoint processes user-supplied input in a way that allows attackers to inject arbitrary PHP functions for execution on the server.

The vulnerability is network-accessible with no authentication requirements, meaning any attacker with network access to the device's web interface can exploit it. The impact is severe across all three pillars of the CIA triad—confidentiality, integrity, and availability are all highly compromised upon successful exploitation.

PHP Function Injection attacks work by manipulating application logic to execute attacker-controlled PHP functions. In this case, the vulnerable endpoint fails to properly validate and sanitize input before processing it, allowing malicious PHP code to be injected and executed with the privileges of the web server process.

Root Cause

The root cause of this vulnerability is missing authentication for a critical function combined with improper input validation. The /webcti/session_ajax.php endpoint does not verify that requests originate from authenticated users before processing potentially dangerous operations. Additionally, user-supplied parameters are not adequately sanitized before being used in PHP function calls, enabling injection of arbitrary PHP commands.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by crafting malicious HTTP requests to the /webcti/session_ajax.php endpoint on exposed Slican devices. The requests contain specially crafted parameters that, when processed by the vulnerable endpoint, result in the execution of attacker-specified PHP functions.

Successful exploitation grants the attacker the ability to execute arbitrary PHP code on the target device, which can lead to complete system compromise. This includes the ability to access sensitive configuration data, intercept communications, install backdoors, or use the compromised device as a pivot point for further attacks within the network.

For detailed technical analysis of this vulnerability, refer to the CERT PL CVE-2025-14577 Analysis.

Detection Methods for CVE-2025-14577

Indicators of Compromise

• Unusual HTTP requests to /webcti/session_ajax.php containing PHP function names or code patterns
• Unexpected outbound network connections from Slican devices
• Anomalous process execution or system commands originating from the web server process
• Log entries indicating authentication bypass or unauthorized access attempts to the WebCTI interface

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block requests containing PHP injection patterns targeting the /webcti/session_ajax.php endpoint
• Implement network intrusion detection signatures for HTTP traffic patterns indicative of PHP function injection attempts
• Monitor Slican device logs for suspicious access patterns to the WebCTI interface, particularly unauthenticated requests to sensitive endpoints
• Conduct periodic vulnerability scans to identify unpatched Slican devices in your environment

Monitoring Recommendations

• Enable verbose logging on Slican devices and forward logs to a centralized SIEM for analysis
• Monitor network traffic to and from Slican telephony devices for anomalous patterns
• Implement alerting for any access to the /webcti/session_ajax.php endpoint from untrusted network segments
• Establish baseline behavior for Slican devices to quickly identify deviations that may indicate compromise

How to Mitigate CVE-2025-14577

Immediate Actions Required

• Update Slican NCP devices to version 1.24.0190 or later immediately
• Update Slican IPL/IPM/IPU devices to version 6.61.0010 or later immediately
• Restrict network access to the WebCTI interface to trusted IP addresses only
• Place Slican telephony devices behind a firewall and limit external exposure

Patch Information

Slican has released security patches addressing this vulnerability. Organizations should update their devices to the following versions:

Contact your Slican vendor representative or visit the Slican product page for firmware download information.

Workarounds

• Implement network segmentation to isolate Slican devices from untrusted networks until patches can be applied
• Deploy a reverse proxy or WAF in front of the WebCTI interface to filter malicious requests
• Disable the WebCTI interface entirely if it is not required for business operations
• Implement IP-based access controls to restrict WebCTI access to authorized management stations only

# Example firewall rule to restrict WebCTI access (iptables)
# Allow WebCTI access only from trusted management network
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP