Slican VoIP devices hit by unauthenticated PHP injection
Unauthenticated remote attackers can execute arbitrary PHP commands on Slican NCP/IPL/IPM/IPU devices via CVE-2025-14577, fixed in versions 1.24.0190 and 6.61.0010.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2025-14577, a PHP function injection vulnerability affecting Slican NCP, IPL, IPM, and IPU devices. The flaw allows unauthenticated remote attackers to execute arbitrary PHP commands by sending specially crafted requests to the /webcti/session_ajax.php endpoint. No authentication is required to exploit this vulnerability.
The vulnerability was responsibly reported by researcher Dariusz Gońda and has been patched by Slican. Organizations running affected devices should upgrade to version 1.24.0190 for Slican NCP models or version 6.61.0010 for Slican IPL, IPM, and IPU models.
Slican devices are VoIP telephony solutions commonly deployed in enterprise environments. The unauthenticated nature of this vulnerability and the ability to execute arbitrary code make it a significant risk to organizations running unpatched systems.
Mentioned in this report
Detection guidance
Slican VoIP session_ajax.php PHP Function Injection Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated HTTP requests to the Slican VoIP /webcti/session_ajax.php endpoint containing PHP code-execution function calls, indicative of CVE-2025-14577 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Slican VoIP session_ajax.php PHP Function Injection Attempt
id: 26a33a39-c198-5ee4-a00c-3525ccee54a5
status: experimental
description: Detects HTTP requests to the Slican VoIP session_ajax.php endpoint that
contain PHP command-execution function names in the URI or request body, matching
the pattern used to exploit CVE-2025-14577 unauthenticated PHP function injection.
references:
- CVE-2025-14577
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: /webcti/session_ajax.php
selection_payload:
cs-uri-query|contains:
- system(
- exec(
- shell_exec(
- passthru(
- popen(
- proc_open(
- assert(
- eval(
condition: selection_endpoint and selection_payload
falsepositives:
- Vulnerability scanners or authorized penetration testers probing the endpoint
- Automated CVE scanning tools validating patch status
level: high
tags:
- attack.t1190
- cve.2025-14577
author: Vorant
Shell Command Execution Spawned by Web Server Process on VoIP/Embedded Device
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Unix shell (/bin/sh, /bin/bash) being spawned as a child of a web server or PHP process, consistent with successful exploitation of an unauthenticated PHP function injection vulnerability such as CVE-2025-14577. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Command Execution Spawned by Web Server Process on VoIP/Embedded Device
id: 4b0c0db7-dbf4-5770-b6a0-756c49b21466
status: experimental
description: Detects a shell interpreter (sh, bash, dash) launched as a direct child
of a web server or PHP-CGI/FPM process, a pattern consistent with remote command
execution following exploitation of a PHP function injection vulnerability like
CVE-2025-14577 in Slican VoIP devices.
references:
- CVE-2025-14577
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-cgi
- /lighttpd
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
filter_common_hooks:
CommandLine|contains:
- logrotate
- cron.daily
condition: selection_parent and selection_child and not filter_common_hooks
falsepositives:
- Legitimate CGI scripts or admin cron jobs that shell out from the web server process
- Custom web application health-check scripts invoking shell utilities
level: high
tags:
- attack.t1059.004
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2025-14577
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs