CVE-2026-35090

{
  "id": "CVE-2026-35090",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T14:16:45.000",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a specific caller ID. This allows them to bypass admin authentication and gain full access to the service protocol and configuration panel. This vulnerability is independent of the telephone exchanges configuration. If remote access is disabled, calling with this caller ID will temporarily enable it.\n\nThis issue was fixed in versions below:\n- IPL-256: version 6.61.0040\n- IPM-032: version 6.61.0040\n- CCT-1668: version 6.56.0430\n- MAC-6400: version 6.56.0430\n- CXS-0424: version 6.30.0510\n\nThe issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below:\n- CCT-1668 (CCT1CPU)\n- MAC-6400\n- CXS-0424\nThese products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading."
    },
    {
      "lang": "es",
      "value": "En las centrales telefónicas Slican es posible gestionar el panel de control de forma remota. Un atacante no autenticado puede conectarse al módem a través de un teléfono con un identificador de llamadas específico. Esto les permite eludir la autenticación de administrador y obtener acceso completo al protocolo de servicio y al panel de configuración. Esta vulnerabilidad es independiente de la configuración de las centrales telefónicas. Si el acceso remoto está deshabilitado, llamar con este identificador de llamadas lo habilitará temporalmente.\n\nEste problema se solucionó en las versiones siguientes:\n- IPL-256: versión 6.61.0040\n- IPM-032: versión 6.61.0040\n- CCT-1668: versión 6.56.0430\n- MAC-6400: versión 6.56.0430\n- CXS-0424: versión 6.30.0510\n\nEl problema AÚN EXISTE en centrales telefónicas fuera de soporte en versiones 4.xx e inferiores:\n- CCT-1668 (CCT1CPU)\n- MAC-6400\n- CXS-0424\nEstos productos fueron descontinuados en 2011 y 2012 y no recibirán actualizaciones. Estos productos requieren una actualización de hardware para poder recibir una actualización de software. El proveedor recomienda que los usuarios de estos dispositivos contacten directamente a su departamento de servicio para determinar las opciones de actualización."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Slican",
          "product": "CCT-1668",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6.56.0430",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Slican",
          "product": "MAC-6400",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6.56.0430",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Slican",
          "product": "CXS-0424",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6.30.0510",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Slican",
          "product": "IPL-256",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6.61.0040",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Slican",
          "product": "IPM-032",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6.61.0040",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-27T15:28:57.242605Z",
          "id": "CVE-2026-35090",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cert.pl/posts/2026/05/CVE-2026-35087",
      "source": "[email protected]"
    }
  ]
}