Slican WebCTI CVE-2026-63315

Exploitation requires prior read access to the WebCTI/IPx backend database where the temporary subscriber password is stored in plaintext - the description states 'an attacker with access to the database can obtain the user's password.' This database access is the hard gate and is not provided by the vulnerability itself; it must come from an insider, stolen or default DB credentials, an exposed/misconfigured datastore, or a separate chained vulnerability. Once that access exists, recovery is trivial (the credential is unencrypted). Limiting factors: affected deployments must run WebCTI on IPx versions prior to 6.62.0100, and the exposed credential is described as a 'temporary' password, so the exploitation window and account scope may be time- or provisioning-limited. The CVSS AT:P metric reflects this required database-access precondition.

This is a confidentiality flaw (CWE-256, plaintext storage of a temporary subscriber password) in Slican's WebCTI service for IPx telephone exchanges, rated CVSS 4.0 base 8.2. The most important signal is a contradiction between the vector and the description: the published CVSS 4.0 vector claims AV:N/PR:N/UI:N (network-reachable, no privileges, no interaction) yet includes AT:P (a present attack requirement), while the description explicitly states 'an attacker with access to the database can obtain the user's password.' In practice this is NOT remote-unauthenticated code exposure - it is a post-access disclosure that presupposes the attacker already holds read access to the backend database (via an insider, a chained vulnerability, stolen DB credentials, or a misconfigured/exposed datastore). The AT:P flag appears to be the vendor's way of encoding that prerequisite, so the effective privilege requirement is materially higher than PR:N implies. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data, so there is no evidence of active or opportunistic exploitation. Net: the raw 8.2 overstates internet-facing risk; the realistic priority is moderate and situational - high impact (full subscriber account takeover once the DB is reached) but gated behind a significant precondition. Treat as a defense-in-depth / insider-and-chaining concern rather than a drop-everything remote threat. Note the AT:P-vs-PR:N tension should be verified with CERT-PL/Slican.

An attacker who has already obtained read access to the WebCTI/IPx backend database - for example a malicious insider, or an outsider who has chained an unrelated database-exposure or credential-theft flaw - queries the stored temporary subscriber password, which is held in plaintext rather than hashed. Using the recovered credential, the attacker logs in directly to the victim's subscriber account. No public exploit code is identified at time of analysis; exploitation is a straightforward database read requiring no special tooling.