What is the CVSS score of CVE-2025-14577?

CVE-2025-14577 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-14577?

Slican telecommunications devices (NCP/IPL/IPM/IPU series) are exposed to a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands without…

How to fix or mitigate CVE-2025-14577?

Within 24 hours: Identify all Slican NCP/IPL/IPM/IPU devices in your environment and isolate the /webcti/session_ajax.php endpoint from untrusted networks; implement emergency WAF rules to block malicious requests to this endpoint. Within 7 days: Deploy network segmentation to restrict access to affected devices to authorized administrators only; enable enhanced logging and monitoring for suspicious activity. Within 30 days: Contact Slican for patch availability and timeline; evaluate replacement or decommissioning if patches remain unavailable; conduct forensic analysis for signs of prior compromise.

PHP CVE-2025-14577

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-02-24 cvd@cert.pl

PHP Ipu 14 Firmware Ipm 032 Firmware Ipl 256 Firmware Ncp Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 14:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint.

This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

AnalysisAI

PHP function injection in Slican NCP/IPL/IPM/IPU VOIP devices allows unauthenticated remote attackers to execute arbitrary PHP functions. Network telecommunications equipment vulnerability.

Technical ContextAI

CWE-306 missing authentication + PHP function injection. Unauthenticated remote attackers can invoke arbitrary PHP functions on the device.

RemediationAI

Apply vendor firmware update. Restrict management access. Segment VOIP infrastructure.

More in PHP

View all

CVE-2012-1823 CRITICAL Act Now POC

9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL Act Now POC

9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2024-11680 CRITICAL Act Now POC

9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL Act Now POC

9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL Act Now POC

9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH Act Now POC

8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL Emergency POC

10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-46506 CRITICAL Emergency POC

10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro

CVE-2024-8353 CRITICAL Act Now POC

9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-306 – Missing Authentication for Critical Function

View all

CVE-2017-10271 HIGH POC

7.5

CVE-2025-3248 CRITICAL POC

9.8

CVE-2024-11680 CRITICAL POC

9.8

CVE-2025-0108 HIGH POC

8.8

CVE-2025-32433 CRITICAL POC

10.0

CVE-2016-2004 CRITICAL POC

9.8

CVE-2024-46506 CRITICAL POC

10.0

CVE-2025-8943 CRITICAL POC

9.8

CVE-2025-14577 vulnerability details – vuln.today

Back

PHP CVE-2025-14577

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in PHP

Same weakness CWE-306 – Missing Authentication for Critical Function

Share

External POC / Exploit Code