CERT Polska discloses Slican PBX flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Three vulnerabilities in Slican telephone exchanges allow traffic decryption, SQL injection, and password theft; IPx fixed, legacy models unpatchable.
CERT Polska coordinated disclosure of three vulnerabilities affecting Slican telephone exchange systems. CVE-2026-35088 involves use of symmetric encryption with a hardcoded secret key embedded in multiple binary files across Slican's product line, allowing an attacker with access to these files to decrypt TCP/IP communications. This was fixed in IPx series version 6.62.0100, but remains unpatched in end-of-life models CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424, which were discontinued in 2011-2012 and will not receive software updates without a hardware upgrade. Affected users of these legacy devices are advised to contact Slican's service department directly.
Two additional vulnerabilities affect the WebCTI service used with Slican IPx exchanges. CVE-2026-63314 is a SQL injection flaw in the /webcti/admin_json.php endpoint, allowing an authenticated attacker to execute arbitrary SQL injection attacks due to improper input neutralization. CVE-2026-63315 involves storage of temporary subscriber passwords in plaintext within the database, allowing an attacker with database access to obtain credentials and log in as the subscriber. Both WebCTI issues were also fixed in IPx series version 6.62.0100.
No evidence of in-the-wild exploitation is mentioned in the advisory. Defenders operating Slican IPx telephone exchanges should upgrade to version 6.62.0100 or later. Organizations still running the EOL CCT-1668, MAC-6400, or CXS-0424 models should contact Slican's service department to discuss hardware/software upgrade paths, as these devices will not receive patches for the hardcoded encryption key issue. Restricting access to exchange binaries, databases, and the WebCTI admin interface is recommended as compensating controls where upgrades are not immediately possible.
Mentioned in this report
Detection guidance
SQL Injection Patterns Against Slican WebCTI admin_json.php
Detects web requests to the Slican WebCTI /webcti/admin_json.php endpoint whose query string carries common SQL injection syntax, as in CVE-2026-63314 (authenticated SQLi). Only the query string is inspected, so POST-body injection will not be seen. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Patterns Against Slican WebCTI admin_json.php
id: 9fe96d2f-81ed-5212-87ed-70cf1dcebe2b
status: experimental
description: Detects requests to the Slican WebCTI /webcti/admin_json.php endpoint
whose query string contains common SQL injection syntax (CVE-2026-63314). Matches
on the endpoint plus generic SQLi tokens, not on any campaign-specific payload.
POST-body injection is not visible in this log source.
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-35088
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|endswith: /webcti/admin_json.php
selection_sqli:
cs-uri-query|contains:
- union select
- union+select
- union%20select
- union all select
- information_schema
- sleep(
- sleep%28
- benchmark(
- waitfor delay
- waitfor%20delay
- extractvalue(
- updatexml(
- ''' or ''1''=''1'
- '%27%20or%20%271%27%3D%271'
- ''' or 1=1'
- '%27%20or%201%3D1'
- pg_sleep
- load_file(
- into outfile
condition: selection_endpoint and selection_sqli
falsepositives:
- Authorised penetration tests or vulnerability scanners run against the PBX web interface
- Web application firewall health checks that replay SQLi test strings
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-35088
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs