Cct 1668
Monthly
Slican telephone exchanges encrypt their TCP/IP signalling and management traffic with a symmetric key that is hardcoded in multiple firmware binaries, so anyone who obtains a single firmware image or device copy can decrypt that traffic on any installation using the same key. The issue is fixed in IPx series version 6.62.0100; CVSS 4.0 rates it 8.2 with attack prerequisites (AT:P) because exploitation also requires a position to capture the encrypted traffic (passive sniffing or MITM on the exchange's network). Three discontinued models - CCT-1668 (CCT1CPU), MAC-6400 and CXS-0424, discontinued in 2011 and 2012 - remain permanently affected because they cannot receive a software fix and require a hardware upgrade. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the impact is confidentiality-only (high), with no integrity or availability effect.
Slican telephone exchanges encrypt their TCP/IP signalling and management traffic with a symmetric key that is hardcoded in multiple firmware binaries, so anyone who obtains a single firmware image or device copy can decrypt that traffic on any installation using the same key. The issue is fixed in IPx series version 6.62.0100; CVSS 4.0 rates it 8.2 with attack prerequisites (AT:P) because exploitation also requires a position to capture the encrypted traffic (passive sniffing or MITM on the exchange's network). Three discontinued models - CCT-1668 (CCT1CPU), MAC-6400 and CXS-0424, discontinued in 2011 and 2012 - remain permanently affected because they cannot receive a software fix and require a hardware upgrade. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the impact is confidentiality-only (high), with no integrity or availability effect.