CVE-2026-35087 Overview
CVE-2026-35087 is an authentication bypass vulnerability affecting Slican telephone exchanges. Attackers can bypass the requirement to enter login credentials by issuing a specific administrative protocol command. The flaw is classified under [CWE-288] Authentication Bypass Using an Alternate Path or Channel.
The vulnerability is exploitable over the network without privileges or user interaction. It affects the confidentiality, integrity, and availability of the targeted exchange. End-of-life devices discontinued in 2011 and 2012 remain permanently exposed because they cannot receive software updates without a hardware refresh.
Critical Impact
Unauthenticated remote attackers can gain administrative control of Slican telephone exchanges, exposing voice infrastructure to interception, configuration tampering, and service disruption.
Affected Products
- Slican NCP exchanges prior to version 1.24.0250
- Slican IPx series prior to version 6.61.0040, and CCT-1668, MAC-6400, CXS-0424 prior to fixed firmware
- End-of-life CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 running versions 4.xx and below (no patch available)
Discovery Timeline
- 2026-05-27 - CVE CVE-2026-35087 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-35087
Vulnerability Analysis
The vulnerability resides in the administrative protocol exposed by Slican telephone exchanges. The protocol accepts a command that grants administrative access without requiring valid credentials. An attacker who can reach the management interface over the network can issue this command and obtain the same privileges as a legitimate administrator.
Because Slican exchanges control voice routing, call detail records, and PBX configuration, administrative access enables call interception, configuration modification, rerouting of outbound calls for toll fraud, and full denial of service. The vulnerability requires no user interaction and no prior foothold.
The affected end-of-life models (CCT-1668, MAC-6400, CXS-0424 running firmware 4.xx or earlier) cannot be patched in software. The vendor states these devices require a hardware upgrade to receive a fixed firmware image.
Root Cause
The administrative protocol implementation contains an alternate command path that does not enforce credential validation. This is a design-level authentication bypass mapped to [CWE-288], where a privileged operation is reachable through a channel that omits the authentication check applied to the standard login flow.
Attack Vector
The attack vector is network-based. An attacker sends the crafted administrative command to the exchange and is granted administrative privileges without supplying credentials. Refer to the CERT Polska security analysis for protocol-level technical details.
Detection Methods for CVE-2026-35087
Indicators of Compromise
- Administrative sessions on the exchange originating from unexpected source IP addresses or external networks
- Configuration changes, new SIP trunks, or call forwarding rules that do not correspond to scheduled administrator activity
- Unexplained spikes in outbound international or premium-rate calls indicating toll fraud after exchange compromise
Detection Strategies
- Monitor the management TCP ports of Slican exchanges for inbound traffic from any host outside the management VLAN
- Audit exchange logs for administrative command execution without a preceding authenticated login event
- Compare running configuration against a known-good baseline at regular intervals to detect unauthorized changes
Monitoring Recommendations
- Forward exchange logs and NetFlow data for the voice management segment to a centralized SIEM for correlation
- Alert on call detail records that show unusual destinations, after-hours volumes, or new dial plans
- Track firmware versions across the Slican fleet to identify devices still running vulnerable releases
How to Mitigate CVE-2026-35087
Immediate Actions Required
- Restrict network access to the administrative protocol of all Slican exchanges to a dedicated management VLAN with strict ACLs
- Inventory all Slican NCP, IPx, CCT-1668, MAC-6400, and CXS-0424 devices and identify firmware versions
- Upgrade supported devices to fixed firmware immediately; isolate end-of-life devices that cannot be patched
- Review call detail records and exchange configuration for signs of prior unauthorized access
Patch Information
The vendor has published fixed firmware for supported product lines. Upgrade to at minimum: NCP 1.24.0250, IPx series 6.61.0040, CCT-1668 6.56.0430, MAC-6400 6.56.0430, and CXS-0424 6.30.0510. End-of-life CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 units running firmware 4.xx or earlier will not receive software updates. The vendor recommends contacting Slican service to evaluate hardware upgrade options. See the CERT Polska advisory for full version guidance.
Workarounds
- Place vulnerable exchanges behind a firewall that blocks all inbound traffic to the administrative protocol from untrusted networks
- Disable any remote management exposure to the internet and require VPN access for administrators
- For end-of-life devices that cannot be patched, segregate them on an isolated network until hardware replacement is completed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
