# CVE-2026-35087: Slican Telephone Exchanges authentication bypass in administrative protocol

Source: https://junglewise.ai/threats/cve-2026-35087-slican-telephone-exchanges-authentication-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-35087 · Severity: info · CVSS 9.3 · Published 2026-05-27

Slican telephone exchanges, which manage corporate voice communications and PBX services, contain a flaw that allows unauthorized individuals to bypass administrative login requirements. By sending a specific command, an attacker can gain full control over the device without needing a password. This could lead to eavesdropping on calls, service disruptions, or unauthorized changes to the organization's telephony infrastructure.

Technologies: [Slican CCT-1668](https://junglewise.ai/threats/technologies/cct-1668), [Slican CXS-0424](https://junglewise.ai/threats/technologies/cxs-0424), [Slican MAC-6400](https://junglewise.ai/threats/technologies/mac-6400). Vendors: [Slican](https://junglewise.ai/threats/vendors/slican).

## Quick answers

**Is CVE-2026-35087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35087 being exploited in the wild.

**How severe is CVE-2026-35087?** Informational severity, with a CVSS score of 9.3, published 27 May 2026.

**Which products and versions are affected?** Slican CCT-1668 below 6.56.0430; 4.xx and below (EOL); Slican CXS-0424 below 6.30.0510; 4.xx and below (EOL); Slican IPx series below 6.61.0040; Slican MAC-6400 below 6.56.0430; 4.xx and below (EOL); and 1 more.

**Is there a fix for CVE-2026-35087?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-35087 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-35087?** Check whether you run Slican CCT-1668, Slican CXS-0424, Slican IPx series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) exists in the administrative protocol of several Slican telephone exchange models. The flaw allows a remote, unauthenticated attacker to bypass the authentication mechanism entirely by executing a specific command within the administrative protocol. Successful exploitation grants the attacker full administrative access to the device. While patches are available for modern firmware branches, several legacy models (CCT-1668, MAC-6400, CXS-0424) running version 4.xx or lower are end-of-life and require hardware upgrades to receive security fixes.

## Affected products

- Slican NCP below 1.24.0250
- Slican IPx series below 6.61.0040
- Slican CCT-1668 below 6.56.0430; 4.xx and below (EOL)
- Slican MAC-6400 below 6.56.0430; 4.xx and below (EOL)
- Slican CXS-0424 below 6.30.0510; 4.xx and below (EOL)

## Timeline

- 2026-05-27: advisory: Initial disclosure by CERT.PL

## References

- [https://cert.pl/posts/2026/05/CVE-2026-35087](https://cert.pl/posts/2026/05/CVE-2026-35087)

## Related threats

- [Slican IPx telephone exchange hardcoded encryption key in binaries](https://junglewise.ai/threats/cve-2026-35088-slican-telephone-exchanges-use-symmetric-encryption-for-tcp-ip)
- [Slican telephone exchanges authentication bypass via specific caller ID](https://junglewise.ai/threats/cve-2026-35090-slican-telephone-exchanges-authentication-bypass-via-specific)
- [Slican telephone exchanges predictable secure key generation](https://junglewise.ai/threats/cve-2026-35089-slican-telephone-exchanges-predictable-secure-key-generation)