Loading vulnerability…
Authenticated SQL Injection in Slican IPx WebCTI
CVE-2026-63314 is an authenticated SQL injection vulnerability in the WebCTI service of Slican IPx telephone exchanges running versions before 6.62.0100. Improper neutralization of input in the administrative JSON endpoint allows an authenticated attacker to inject SQL commands into database queries. Exploitation can compromise database confidentiality and integrity and affect service availability. The vulnerability was fixed in IPx version 6.62.0100.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of the vulnerable service's database and cause limited availability disruption. The CVSS v4.0 assessment specifies high confidentiality and integrity impacts and low availability impact to the vulnerable system, with no impacts to subsequent systems. The precise scope of accessible records and permitted database operations is not established.
If you can’t patch tonight, do this now.
Pending an upgrade, restrict WebCTI access to trusted users and management networks, and disable the service if it is not required. These measures reduce exposure but do not correct the SQL injection vulnerability.
Patch, then assume compromise.
Upgrade affected Slican IPx telephone exchanges to IPx series version 6.62.0100 or a later vendor-supported release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.