Slican IPx WebCTI EUVD-2026-101951

Requires authenticated access to the Slican WebCTI service (PR:L - a valid low-privilege subscriber/operator account or an active session) and network reachability to the /webcti/admin_json.php endpoint, which belongs to the WebCTI subscriber application running on the IPx exchange. Exploitation is otherwise low-complexity and needs no user interaction. The primary limiting factor is the authentication requirement, so risk is substantially reduced when WebCTI is not exposed to untrusted networks and account access is tightly controlled; only deployments running WebCTI on IPx firmware prior to 6.62.0100 are affected.

This is a CWE-89 SQL injection in the WebCTI /webcti/admin_json.php endpoint of Slican IPx telephone exchanges, carrying a vendor/CERT-PL CVSS 4.0 base score of 8.7 (High). The vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only low-level authentication and no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) and low availability impact (VA:L) - consistent with a SQLi that can read and manipulate backend database contents. Exploitation status is 'no public exploit identified at time of analysis': the input provides no EPSS score, no KEV listing, and no POC flag, so there is no evidence of active or automated exploitation. The authentication requirement (PR:L) is a meaningful mitigating factor that lowers real-world risk relative to an unauthenticated flaw, and the affected product is a niche regional PBX platform rather than ubiquitous software, which further narrows the practical attack surface. Net assessment: a genuinely serious post-authentication vulnerability for organizations running Slican IPx, but not a mass-exploitation emergency - prioritize patching for exposed/management-reachable WebCTI instances. Missing signals (EPSS, KEV, POC) are unknowns rather than confirmed negatives; absence of data is not proof of absence of exploitation.

An attacker who has obtained low-privilege authenticated access to the WebCTI service (e.g., a valid subscriber/operator account or stolen session) sends crafted input to the /webcti/admin_json.php endpoint, where improper neutralization allows injection of SQL into backend queries. Given AV:N/AC:L, this is achievable remotely over the network with a simple, reliable request, letting the attacker read or alter database contents (call records, credentials, configuration). No public proof-of-concept is identified at time of analysis.