Slican VoIP devices hit by unauthenticated PHP injection

24 February 2026 routine vulnerability telecommunications

Unauthenticated remote attackers can execute arbitrary PHP commands on Slican NCP/IPL/IPM/IPU devices via CVE-2025-14577, fixed in versions 1.24.0190 and 6.61.0010.

CERT Polska coordinated disclosure of CVE-2025-14577, a PHP function injection vulnerability affecting Slican NCP, IPL, IPM, and IPU devices. The flaw allows unauthenticated remote attackers to execute arbitrary PHP commands by sending specially crafted requests to the /webcti/session_ajax.php endpoint. No authentication is required to exploit this vulnerability.

The vulnerability was responsibly reported by researcher Dariusz Gońda and has been patched by Slican. Organizations running affected devices should upgrade to version 1.24.0190 for Slican NCP models or version 6.61.0010 for Slican IPL, IPM, and IPU models.

Slican devices are VoIP telephony solutions commonly deployed in enterprise environments. The unauthenticated nature of this vulnerability and the ability to execute arbitrary code make it a significant risk to organizations running unpatched systems.

Mentioned in this report

Vulnerabilities CVE-2025-14577

Detection guidance

Slican VoIP session_ajax.php PHP Function Injection Attempt

ATT&CK T1190

Detects unauthenticated HTTP requests to the Slican VoIP /webcti/session_ajax.php endpoint containing PHP code-execution function calls, indicative of CVE-2025-14577 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Slican VoIP session_ajax.php PHP Function Injection Attempt
id: 26a33a39-c198-5ee4-a00c-3525ccee54a5
status: experimental
description: Detects HTTP requests to the Slican VoIP session_ajax.php endpoint that
  contain PHP command-execution function names in the URI or request body, matching
  the pattern used to exploit CVE-2025-14577 unauthenticated PHP function injection.
references:
- CVE-2025-14577
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: /webcti/session_ajax.php
  selection_payload:
    cs-uri-query|contains:
    - system(
    - exec(
    - shell_exec(
    - passthru(
    - popen(
    - proc_open(
    - assert(
    - eval(
  condition: selection_endpoint and selection_payload
falsepositives:
- Vulnerability scanners or authorized penetration testers probing the endpoint
- Automated CVE scanning tools validating patch status
level: high
tags:
- attack.t1190
- cve.2025-14577
author: Vorant

Shell Command Execution Spawned by Web Server Process on VoIP/Embedded Device

ATT&CK T1059.004

Detects a Unix shell (/bin/sh, /bin/bash) being spawned as a child of a web server or PHP process, consistent with successful exploitation of an unauthenticated PHP function injection vulnerability such as CVE-2025-14577. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shell Command Execution Spawned by Web Server Process on VoIP/Embedded Device
id: 4b0c0db7-dbf4-5770-b6a0-756c49b21466
status: experimental
description: Detects a shell interpreter (sh, bash, dash) launched as a direct child
  of a web server or PHP-CGI/FPM process, a pattern consistent with remote command
  execution following exploitation of a PHP function injection vulnerability like
  CVE-2025-14577 in Slican VoIP devices.
references:
- CVE-2025-14577
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /php-cgi
    - /lighttpd
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  filter_common_hooks:
    CommandLine|contains:
    - logrotate
    - cron.daily
  condition: selection_parent and selection_child and not filter_common_hooks
falsepositives:
- Legitimate CGI scripts or admin cron jobs that shell out from the web server process
- Custom web application health-check scripts invoking shell utilities
level: high
tags:
- attack.t1059.004
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/02/CVE-2025-14577

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free