CVE-2026-35089

Vulnerability

The vulnerability exists in Slican telephone exchange models IPx, CCT-1668, MAC-6400, and CXS-0424. The secure key used for authentication is generated in a predictable manner based on device properties that can be obtained without authentication. Affected versions: IPx below 6.61.0040, CCT-1668 and MAC-6400 below 6.56.0430, CXS-0424 below 6.30.0510. End-of-life versions 4.xx and below for CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 remain vulnerable with no fix available [1].

Exploitation

An unauthenticated attacker can obtain device properties (e.g., serial number, MAC address) without authentication. Using these properties, the attacker can predict the secure key. The attacker then uses this key to obtain admin credentials. No user interaction or special network position is required beyond network access to the telephone exchange [1].

Impact

Successful exploitation allows an unauthenticated attacker to gain administrative access to the telephone exchange. This leads to full compromise of the device, including potential control over telephony services, access to call logs, and ability to modify configurations. The impact is high due to the ease of exploitation and the critical nature of telephone exchanges [1].

Mitigation

The vendor has released fixed versions: IPx 6.61.0040, CCT-1668 and MAC-6400 6.56.0430, CXS-0424 6.30.0510. Users should update to these versions. For End-of-Life devices (CCT-1668 CCT1CPU, MAC-6400, CXS-0424) running versions 4.xx and below, no software update is available; these products were discontinued in 2011-2012 and require a hardware upgrade. The vendor recommends contacting their service department for upgrade options [1].