CVE-2026-63315: Plaintext storage of a password in WebCTI
Published Oct 15, 2026
·Updated
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.
This issue was fixed in IPx series version 6.62.0100.
Affected Software
1 affected component
SLICAN WebCTI<6.62.0100
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Slican IPx WebCTIto a version that resolves this vulnerability.Fixed in 6.62.0100
Event History
Oct 15, 2026
CVE Published
via MITRE·09:00 AM
Data Sourced
via MITRE·09:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs access to the WebCTI database. With that access, they can retrieve a temporarily stored subscriber password and use it to log in to the subscriber's account.
2
Which version resolves the issue?
The issue was fixed in Slican IPx series version 6.62.0100.