CVE-2026-63315

HighCVSS 8.2

Published: 15/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

The WebCTI service for Slican IPx telephone exchanges stores temporary subscriber passwords in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.

Risk Assessment

Disclosure of subscriber passwords enables account takeover and unauthorized access to telephony services.

Recommendation

Upgrade IPx exchanges to version 6.62.0100 or later, where the issue has been fixed.

Other vulnerabilities in Slican IPx WebCTI

CVE-2026-63314High
The WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in the /webcti/admin_json.php endpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.

Original NVD description (English source)

WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS