Slican Fixes Three PBX Flaws; Hardcoded Encryption Key Remains in End-of-Life Models

CERT Polska disclosed three vulnerabilities in Slican telephone exchanges, including a hardcoded symmetric encryption key that could allow attackers with access to relevant binary files to decrypt TCP/IP communications. The flaw, tracked as CVE-2026-35088, undermines communications confidentiality. The other vulnerabilities are CVE-2026-63314, an authenticated SQL injection flaw in the IPx WebCTI service, and CVE-2026-63315, which exposes temporary subscriber passwords stored in plaintext to attackers with database access.

Slican fixed all three vulnerabilities in IPx version 6.62.0100. However, the hardcoded-key vulnerability remains unresolved in the end-of-life CCT-1668, MAC-6400, and CXS-0424 models, which require hardware upgrades to receive updated software. Organizations should inventory their Slican exchanges, update supported IPx deployments, and prioritize replacement of affected legacy hardware; restricting WebCTI and database access can reduce exposure but does not resolve the underlying flaws.