CVE-2026-35090

Vulnerability

An authentication bypass vulnerability exists in Slican telephone exchange firmware. An unauthenticated attacker can connect to the modem via a telephone call using a specific caller ID to bypass the admin authentication and gain full access to the service protocol and configuration panel [1]. This issue is independent of the telephone exchange's configuration; even if remote access is disabled, calling with the specific caller ID temporarily enables it. Affected versions are IPL-256 and IPM-032 below 6.61.0040, CCT-1668 and MAC-6400 below 6.56.0430, and CXS-0424 below 6.30.0510 [1]. End-of-life products (CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424, versions 4.xx and below, discontinued in 2011 and 2012) remain vulnerable and will not receive a software patch [1].

Exploitation

An attacker needs only a telephone line and a modem capable of generating a specific caller ID [1]. No authentication is required, and no user interaction on the target device is needed. The attacker places a call to the modem of the Slican telephone exchange with the designated caller ID; upon connection, the attacker immediately bypasses admin authentication and gains access to the service protocol and configuration panel [1].

Impact

Successful exploitation grants an unauthenticated attacker full administrative access to the service protocol and configuration panel of the Slican telephone exchange [1]. This allows complete compromise of the device's configuration, including the ability to alter settings, intercept or redirect communications, and potentially disrupt telephone services. The impact is considered critical due to the lack of required privileges and the ability to bypass authentication entirely [1].

Mitigation

Slican has released fixed firmware versions: IPL-256 and IPM-032 version 6.61.0040, CCT-1668 and MAC-6400 version 6.56.0430, and CXS-0424 version 6.30.0510 [1]. Users of supported devices should upgrade immediately. For end-of-life devices (CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 versions 4.xx and below), no software patch is available; the vendor recommends contacting their service department to discuss hardware upgrade options [1]. If an immediate upgrade is not possible, disabling remote modem access or physically disconnecting the modem may reduce the attack surface, though the vendor advises that calling with the specific caller ID may still re-enable disabled remote access [1].