Slican
Monthly
Slican's WebCTI subscriber service for IPx telephone exchanges stores the temporary subscriber password in plaintext, so anyone able to read the backend database can recover the credential and authenticate as that subscriber. Only IPx deployments running WebCTI on versions prior to 6.62.0100 are affected, and the practical gate is prior read access to the database (an insider, stolen or default DB credentials, an exposed datastore, or a chained flaw), so this is best characterized as a credential-recovery weakness triggered after some other access is obtained rather than a directly reachable entry point; the assessed vector (CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects that high-privilege prerequisite, while the CVSS 4.0 data rates it 8.2 with AT:P. Exposure is confidentiality-only (CWE-256) with no integrity or availability impact, there is no evidence of exploitation, and no public exploit code exists; no KEV listing and no EPSS signal were provided. Because the stored secret is described as a temporary password, the exploitation window and account scope may be limited by provisioning lifetime.
SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Slican's WebCTI subscriber service for IPx telephone exchanges stores the temporary subscriber password in plaintext, so anyone able to read the backend database can recover the credential and authenticate as that subscriber. Only IPx deployments running WebCTI on versions prior to 6.62.0100 are affected, and the practical gate is prior read access to the database (an insider, stolen or default DB credentials, an exposed datastore, or a chained flaw), so this is best characterized as a credential-recovery weakness triggered after some other access is obtained rather than a directly reachable entry point; the assessed vector (CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects that high-privilege prerequisite, while the CVSS 4.0 data rates it 8.2 with AT:P. Exposure is confidentiality-only (CWE-256) with no integrity or availability impact, there is no evidence of exploitation, and no public exploit code exists; no KEV listing and no EPSS signal were provided. Because the stored secret is described as a temporary password, the exploitation window and account scope may be limited by provisioning lifetime.
SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.