CVE-2026-35090: Slican telephone exchanges authentication bypass via specific caller ID

CVE-2026-35090 · Severity: info · CVSS 9.3 · Published 2026-05-27

Slican telephone exchanges contain a critical flaw that allows an unauthorized person to take full control of the device. By calling the system's modem using a specific, spoofed caller ID, an attacker can bypass all security checks and access the administrative configuration panel. This can lead to unauthorized monitoring of calls, service disruption, or complete reconfiguration of the organization's phone system.

Technologies: Slican CCT-1668, Slican CXS-0424, Slican MAC-6400. Vendors: Slican.

Quick answers

Is CVE-2026-35090 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35090 being exploited in the wild.
How severe is CVE-2026-35090?
Informational severity, with a CVSS score of 9.3, published 27 May 2026.
Which products and versions are affected?
Slican CCT-1668 below 6.56.0430; Slican CXS-0424 below 6.30.0510; Slican IPL-256 below 6.61.0040; Slican IPM-032 below 6.61.0040; and 1 more.
Is there a fix for CVE-2026-35090?
A patch was published on 2026-05-27: Fixes released for supported models; EoL models remain vulnerable without hardware upgrades. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35090 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35090?
Check whether you run Slican CCT-1668, Slican CXS-0424, Slican IPL-256 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Slican telephone exchanges (CWE-288) allows for an authentication bypass via an alternate path. An unauthenticated attacker can connect to the device's modem using a specific, hardcoded or predefined caller ID. This action bypasses administrative authentication and grants full access to the service protocol and configuration panel. Notably, the vulnerability is independent of the device configuration; even if remote access is explicitly disabled, a call from the specific caller ID will temporarily enable it. Patches are available for current models, but legacy End-of-Life (EoL) hardware (versions 4.xx and below) requires a hardware upgrade to receive the fix.

Affected products

  • Slican IPL-256 below 6.61.0040
  • Slican IPM-032 below 6.61.0040
  • Slican CCT-1668 below 6.56.0430
  • Slican MAC-6400 below 6.56.0430
  • Slican CXS-0424 below 6.30.0510

Timeline

  • 2026-05-27: advisory: Advisory published by CERT.PL
  • 2026-05-27: patched: Fixes released for supported models; EoL models remain vulnerable without hardware upgrades.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.