Loading vulnerability…
Hardcoded Encryption Key in Slican Telephone Exchanges
CVE-2026-35088 affects Slican IPx telephone exchanges before version 6.62.0100 and all versions of the discontinued CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 models. These exchanges use symmetric encryption for TCP/IP communications with a secret key hardcoded in multiple binary files. An attacker with access to those binaries can recover the key and decrypt affected communications. The issue is fixed in IPx version 6.62.0100 but remains unresolved on the affected end-of-life hardware.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation compromises the confidentiality of affected TCP/IP communications by allowing their decryption using the recovered hardcoded key. The vulnerability is rated as having high confidentiality impact to the vulnerable system and low confidentiality impact to subsequent systems, with no integrity or availability impact.
If you can’t patch tonight, do this now.
No interim technical workaround is specified. For affected end-of-life exchanges, coordinate a hardware upgrade with Slican's service department.
Patch, then assume compromise.
Upgrade Slican IPx exchanges to version 6.62.0100 or later. The affected CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 exchanges were discontinued in 2011 and 2012 and will not receive software updates on their existing hardware. Contact Slican's service department to determine hardware upgrade options that enable installation of supported, fixed software.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.