# CVE-2026-35088: Slican IPx telephone exchange hardcoded encryption key in binaries

Source: https://junglewise.ai/threats/cve-2026-35088-slican-telephone-exchanges-use-symmetric-encryption-for-tcp-ip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-35088 · Severity: info · Published 2026-10-15

Slican telephone exchanges, which are critical voice communication systems used in business networks, use a hardcoded symmetric encryption key embedded in software files. An attacker with access to these binary files can extract the key and decrypt all TCP/IP communications between exchange components and connected systems, potentially exposing sensitive call data and call metadata. The vulnerability affects end-of-life models that will not receive patches and requires hardware replacement to remediate.

Technologies: [Slican CCT-1668](https://junglewise.ai/threats/technologies/cct-1668), [Slican CXS-0424](https://junglewise.ai/threats/technologies/cxs-0424), [Slican IPx](https://junglewise.ai/threats/technologies/slican-ipx), [Slican MAC-6400](https://junglewise.ai/threats/technologies/mac-6400). Vendors: [Slican](https://junglewise.ai/threats/vendors/slican).

## Quick answers

**Is CVE-2026-35088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35088 being exploited in the wild.

**How severe is CVE-2026-35088?** Informational severity, published 15 October 2026.

**Which products and versions are affected?** Slican CCT-1668 all; Slican CXS-0424 all; Slican IPx before 6.62.0100; Slican MAC-6400 all.

**Is there a fix for CVE-2026-35088?** Yes: fixed in IPx series 6.62.0100. Until then: The vendor recommends that users of affected end-of-life devices (CCT-1668, MAC-6400, CXS-0424) contact their service department to determine available upgrade options, which may involve hardware replacement. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35088 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-35088?** Check whether you run Slican CCT-1668, Slican CXS-0424, Slican IPx or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in IPx series 6.62.0100

The vendor recommends that users of affected end-of-life devices (CCT-1668, MAC-6400, CXS-0424) contact their service department to determine available upgrade options, which may involve hardware replacement.

## Technical details

The vulnerability involves hardcoded symmetric encryption keys in binary files used for TCP/IP communication in Slican telephone exchange systems. An attacker with access to the system's binary files can extract the key and decrypt all inter-component communications. The issue was patched in IPx series version 6.62.0100, but legacy models (CCT-1668, MAC-6400, CXS-0424) remain vulnerable and unfixable via software update due to end-of-life status and hardware limitations.

## Affected products

- Slican IPx before 6.62.0100
- Slican CCT-1668 all
- Slican MAC-6400 all
- Slican CXS-0424 all

## Timeline

- 2026-10-15: disclosed

## References

- [https://cert.pl/posts/2026/10/CVE-2026-35088](https://cert.pl/posts/2026/10/CVE-2026-35088)

## Related threats

- [Slican IPx WebCTI plaintext password storage](https://junglewise.ai/threats/cve-2026-63315-webcti-service-for-slican-ipx-telephone-exchanges-stores)
- [Slican IPx SQL injection in WebCTI admin endpoint](https://junglewise.ai/threats/cve-2026-63314-webcti-service-for-slican-ipx-telephone-exchanges-is-vulnerable)
- [Slican telephone exchanges authentication bypass via specific caller ID](https://junglewise.ai/threats/cve-2026-35090-slican-telephone-exchanges-authentication-bypass-via-specific)
- [Slican telephone exchanges predictable secure key generation](https://junglewise.ai/threats/cve-2026-35089-slican-telephone-exchanges-predictable-secure-key-generation)
- [Slican Telephone Exchanges authentication bypass in administrative protocol](https://junglewise.ai/threats/cve-2026-35087-slican-telephone-exchanges-authentication-bypass-in)