CVE-2026-35088: Inadequate Encryption Strength in Slican telephone exchanges
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication.
This issue was fixed in IPx series version 6.62.0100.
The issue STILL EXISTS in End-Of-Life telephone exchanges: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Slican IPx seriesto a version that resolves this vulnerability.Fixed in 6.62.0100
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must obtain access to binary files that contain the hardcoded symmetric key. With that key, they can decrypt TCP/IP communication.
Which systems will not receive a software fix?
The CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 exchanges remain affected. They are end-of-life products and will not receive updates.
What is the remediation for IPx-series exchanges?
The issue was fixed in Slican IPx series version 6.62.0100.
What should organizations using the end-of-life exchanges do?
These systems require a hardware update before they can receive a software update. The vendor recommends contacting its service department to determine upgrade options.