CVE-2026-35088: Slican IPx telephone exchange hardcoded encryption key in binaries

CVE-2026-35088 · Severity: info · Published 2026-10-15

Slican telephone exchanges, which are critical voice communication systems used in business networks, use a hardcoded symmetric encryption key embedded in software files. An attacker with access to these binary files can extract the key and decrypt all TCP/IP communications between exchange components and connected systems, potentially exposing sensitive call data and call metadata. The vulnerability affects end-of-life models that will not receive patches and requires hardware replacement to remediate.

Technologies: Slican CCT-1668, Slican CXS-0424, Slican IPx, Slican MAC-6400. Vendors: Slican.

Quick answers

Is CVE-2026-35088 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35088 being exploited in the wild.
How severe is CVE-2026-35088?
Informational severity, published 15 October 2026.
Which products and versions are affected?
Slican CCT-1668 all; Slican CXS-0424 all; Slican IPx before 6.62.0100; Slican MAC-6400 all.
Is there a fix for CVE-2026-35088?
Yes: fixed in IPx series 6.62.0100. Until then: The vendor recommends that users of affected end-of-life devices (CCT-1668, MAC-6400, CXS-0424) contact their service department to determine available upgrade options, which may involve hardware replacement. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35088 attacked?
It is attacked with local access.
Am I affected by CVE-2026-35088?
Check whether you run Slican CCT-1668, Slican CXS-0424, Slican IPx or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: IPx series 6.62.0100

The vendor recommends that users of affected end-of-life devices (CCT-1668, MAC-6400, CXS-0424) contact their service department to determine available upgrade options, which may involve hardware replacement.

Technical details

The vulnerability involves hardcoded symmetric encryption keys in binary files used for TCP/IP communication in Slican telephone exchange systems. An attacker with access to the system's binary files can extract the key and decrypt all inter-component communications. The issue was patched in IPx series version 6.62.0100, but legacy models (CCT-1668, MAC-6400, CXS-0424) remain vulnerable and unfixable via software update due to end-of-life status and hardware limitations.

Affected products

  • Slican IPx before 6.62.0100
  • Slican CCT-1668 all
  • Slican MAC-6400 all
  • Slican CXS-0424 all

Timeline

  • 2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.