Loading vulnerability…
Plaintext Temporary Password Storage in Slican IPx WebCTI
CVE-2026-63315 affects the WebCTI service in Slican IPx telephone exchanges running versions before 6.62.0100. The service stores temporary subscriber passwords in plaintext, allowing an attacker with database access to retrieve these credentials and use them to log in to subscriber accounts.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exposure of plaintext temporary subscriber passwords compromises credential confidentiality and enables unauthorized access to affected subscriber accounts. The vulnerability does not itself establish how an attacker obtains database access.
If you can’t patch tonight, do this now.
No specific workaround is documented. Pending an upgrade, restrict database access to authorized users and services to reduce the risk of credential exposure.
Patch, then assume compromise.
Upgrade Slican IPx telephone exchanges to version 6.62.0100 or later, which fixes the plaintext password storage vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.