CVE-2026-35089: Slican Telephone Exchange Auth Bypass Flaw

CVE-2026-35089 Overview

CVE-2026-35089 affects Slican telephone exchanges. The device generates its secure key from properties that an unauthenticated attacker can retrieve over the network. Because the derivation is predictable, an attacker can reproduce the key and recover administrator credentials without prior access.

The weakness is classified under CWE-1391: Use of Weak Credentials. The vendor released fixes for current product lines, but several end-of-life models discontinued in 2011 and 2012 remain affected and cannot receive software updates without hardware replacement.

Critical Impact
An unauthenticated network attacker can deduce administrator credentials on affected Slican telephone exchanges, leading to full administrative compromise of the PBX.

Affected Products

Slican IPx series prior to version 6.61.0040
Slican CCT-1668, MAC-6400 prior to version 6.56.0430; CXS-0424 prior to version 6.30.0510
End-of-life CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 running firmware version 4.xx and below (no fix available)

Discovery Timeline

2026-05-27 - CVE-2026-35089 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-35089

Vulnerability Analysis

The vulnerability stems from a deterministic key derivation scheme used by Slican telephone exchanges. The exchange computes its secure key from device properties that are exposed by the system over the network. An unauthenticated attacker can query these properties, reproduce the derivation, and reconstruct the same secure key that the device uses internally.

Once the key is known, the attacker can decrypt or forge data that the device trusts as authenticated, including the administrator credential material. This collapses the authentication boundary of the PBX to a value that any network-reachable client can compute.

The issue is tracked under CWE-1391: Use of Weak Credentials. Additional technical context is published in the CERT.PL advisory on related Slican issues.

Root Cause

The secure key is not generated from a cryptographically random source. Instead, it is derived from static or low-entropy device attributes that the exchange itself reveals on the network without requiring authentication. Any party able to read those properties can replay the same derivation locally.

Attack Vector

The attack is performed over the network and requires no authentication or user interaction. An attacker queries the telephone exchange for the device properties used in key generation, runs the same derivation logic offline, and obtains administrator credentials. No verified public exploit code is available at this time. See the CERT.PL advisory for additional technical context.

Detection Methods for CVE-2026-35089

Indicators of Compromise

Unexpected administrative logins to the Slican web or management interface from external or unfamiliar internal addresses.
Network requests from untrusted hosts that enumerate device identity or property endpoints prior to a successful admin authentication event.
Configuration changes on the PBX (dial plans, SIP trunks, call forwarding rules) that do not correlate with authorized administrator activity.

Detection Strategies

Inventory all Slican exchanges and identify firmware versions to flag any device below the fixed releases or running 4.xx end-of-life firmware.
Inspect management interface logs for repeated property enumeration followed by administrator login from the same source.
Alert on administrative sessions to the PBX originating from outside designated management subnets.

Monitoring Recommendations

Forward PBX authentication and configuration-change logs to a centralized logging or SIEM platform for retention and correlation.
Monitor outbound calling patterns for toll fraud indicators, including high-volume international or premium-rate destinations.
Track SIP trunk and extension creation events, which are common post-compromise actions on a hijacked PBX.

How to Mitigate CVE-2026-35089

Immediate Actions Required

Upgrade supported devices to fixed firmware: IPx series 6.61.0040, CCT-1668 and MAC-6400 6.56.0430, CXS-0424 6.30.0510.
Remove management interfaces of Slican exchanges from the public internet and restrict access to a dedicated administrative VLAN.
Rotate all administrator credentials on affected devices after patching, since prior keys must be assumed compromised.
For end-of-life CCT-1668, MAC-6400, and CXS-0424 units running 4.xx firmware, contact Slican service to evaluate hardware replacement options.

Patch Information

Slican has released fixed firmware for currently supported product lines. Administrators must apply IPx series 6.61.0040, CCT-1668 6.56.0430, MAC-6400 6.56.0430, or CXS-0424 6.30.0510 as applicable. The end-of-life CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 products discontinued in 2011 and 2012 will not receive software updates and require a hardware update to be eligible for fixed firmware. Refer to the CERT.PL advisory for vendor coordination details.

Workarounds

Place affected exchanges behind a firewall that permits management access only from trusted administrator hosts.
Disable or filter the network services that expose device properties used in key derivation where the configuration allows.
Segment the voice network from general user networks so unauthenticated hosts cannot reach the PBX management plane.
For unsupported end-of-life hardware, plan migration to a current Slican platform on fixed firmware.

bash

# Example: restrict access to the Slican management interface to a trusted admin subnet
# (Adapt interface names and addresses to your environment.)
iptables -A INPUT -p tcp -s 10.10.50.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -j DROP