CVE-2025-14577: PHP Function Injection in Slican NPC/IPL/IPM/IPU
Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/sessionajax.php endpoint.
This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14577?
CVE-2025-14577 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-14577?
To mitigate CVE-2025-14577, update the affected Slican devices to the latest firmware versions provided by the vendor.
Who is affected by CVE-2025-14577?
CVE-2025-14577 affects Slican NCP devices and Slican IPL/IPM/IPU devices running versions prior to 1.24.0190 and 6.61.0010 respectively.
Can CVE-2025-14577 be exploited remotely?
Yes, CVE-2025-14577 can be exploited remotely by an unauthenticated attacker through specially crafted requests.
What impact does CVE-2025-14577 have on my systems?
Exploitation of CVE-2025-14577 allows attackers to execute arbitrary PHP commands, potentially compromising system integrity and security.