Slican telephone exchanges: Hardcoded cryptographic key in TCP/IP communication
Summary
Slican telephone exchanges use a symmetric key for TCP/IP communication that is hardcoded in several binary files. An attacker who gets access to these files can decrypt the communication, which results in loss of confidentiality. The IPx series is fixed in version 6.62.0100, while the end-of-life models CCT-1668, MAC-6400 and CXS-0424 remain unpatched.
Affected
- IPx: all versions below 6.62.0100
- CCT-1668 (CCT1CPU): all versions (CVE record lists up to and including 6.56.0430)
- MAC-6400: all versions (CVE record lists up to and including 6.56.0430)
- CXS-0424: all versions (CVE record lists up to and including 6.30.0510)
Fixed in
- IPx: fixed in version 6.62.0100
- CCT-1668, MAC-6400, CXS-0424: no fix available; the vendor states these discontinued models require a hardware upgrade to receive software updates
Workaround
- No vendor-documented workaround.
- Contact the Slican service department about upgrade options for end-of-life models.
- Restrict network access to the TCP/IP interface of the exchange and limit access to firmware images and binaries (own analysis, not a vendor source).
Exploitation
- No known in-the-wild exploitation.
- VulDB states that no exploit exists.
- Not listed in CISA KEV according to Strix; not verified directly against CISA.
- EPSS 0.00117.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Inventory all Slican devices and record model and firmware version.
- Upgrade IPx systems to 6.62.0100 or later.
- Treat CCT-1668, MAC-6400 and CXS-0424 as unpatched: plan replacement and restrict network access to them in the meantime.
- Check EOL devices also for CVE-2026-35089 (predictable key generation, May 2026).
- Confirm that WebCTI (co-disclosed CVE-2026-63314 and CVE-2026-63315) and management interfaces are not reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory CVE-2026-35088 cert.pl
- VulDB entry 420562 vuldb.com
- Mallory summary mallory.ai
- Strix CVE-2026-35088 www.strix.ai
- OffSeq radar CVE-2026-35088 radar.offseq.com
- Vulners PT-2026-114861 vulners.com
- CERT Polska advisory CVE-2026-35087 (May 2026) cert.pl
- Strix CVE-2026-35089 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:03.
Original description (NVD)
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication. This issue was fixed in IPx series version 6.62.0100. The issue STILL EXISTS in End-Of-Life telephone exchanges: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.