Slican PBX CVE-2026-35089

No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated exploitation with no user interaction, and the description states the key-deriving properties 'can be obtained without authentication.' The required prerequisite is network access to a vulnerable Slican exchange (IPx <6.61.0040, CCT-1668 <6.56.0430, MAC-6400 <6.56.0430, CXS-0424 <6.30.0510, or any EOL 4.xx-and-below CCT-1668/MAC-6400/CXS-0424 unit). The principal limiting factor is exposure: an exchange isolated on a trusted management segment and unreachable from attacker-controlled networks cannot be targeted, since the weakness has no remote-bypass component other than reaching the device.

All signals point to a genuine, high-priority exposure for internet- or LAN-reachable Slican units. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes a network-reachable, low-complexity, no-authentication, no-user-interaction attack that fully compromises confidentiality (admin credentials), with no integrity or availability impact directly from the disclosure itself - consistent with the 8.7 'High' score and the 'Information Disclosure' tag. The practical impact is larger than the confidentiality-only vector suggests, because the leaked credentials grant administrative control as a follow-on. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from this dataset; the absence of those signals lowers the immediacy somewhat but does not reduce the severity of the underlying weakness, which is deterministic and reliable once understood. The 'Microsoft' tag in the input appears spurious/mislabeled - Slican is a Polish telephony vendor and the tag should be disregarded.

An attacker who can reach a Slican exchange over the network queries the device's unauthenticated properties, feeds them into the predictable key-derivation routine to reconstruct the secure key, and uses it to recover the administrator credentials. With admin access the attacker can reconfigure the PBX - for example to reroute or eavesdrop on calls or commit toll fraud. No public exploit was identified at time of analysis, but the low complexity and lack of authentication make reliable exploitation straightforward once the algorithm is known.