Slican PBX CVE-2026-35087

The attacker must have network reachability to the Slican exchange's administrative management protocol and then execute a specific command that bypasses credential entry; per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no privileges, and no user interaction are required against affected versions. The primary limiting factor is exposure of the administrative protocol - PBX management interfaces are commonly segmented to internal or management networks, so an attacker typically needs access to that network rather than arbitrary internet access. The other limiting factor is version: devices running the fixed versions (NCP 1.24.0250, IPx 6.61.0040, CCT-1668/MAC-6400 6.56.0430, CXS-0424 6.30.0510) are not vulnerable, while EOL CCT-1668/MAC-6400/CXS-0424 units at 4.xx and below remain exploitable with no software remedy.

All available signals point to genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no privileges, no special attack requirements, and no user interaction, with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) - i.e., a complete administrative compromise of the telephony system. The 9.3 base score is consistent with this vector. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk rating therefore rests on exploitability characteristics rather than observed attacks. The most important nuance is exposure: PBX administrative interfaces are frequently confined to internal/management networks, so real-world reachability depends heavily on whether the admin protocol is exposed to untrusted networks - a device behind proper network segmentation faces materially lower practical risk than the raw AV:N score suggests. The standout durable risk is the EOL fleet (CCT-1668, MAC-6400, CXS-0424 at 4.xx and below), which will never receive a software-only fix.

An attacker with network access to a Slican exchange's administrative protocol connects to the management interface and, instead of supplying valid operator credentials, issues the specific command that bypasses the login check, immediately obtaining administrative access. From there the attacker can reconfigure call routing, intercept or reroute calls, exfiltrate configuration, or disable the exchange. No public proof-of-concept was identified in the available data, but the low attack complexity and lack of any authentication or user interaction make exploitation straightforward for anyone who can reach the interface.