CVE-2026-35089

published 2026-05-27

CVE-2026-35089: In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without…

Priority P3 59 high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials.

This issue was fixed in versions below:
- IPx series: version 6.61.0040
- CCT-1668: version 6.56.0430
- MAC-6400: version 6.56.0430
- CXS-0424: version 6.30.0510

The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below:
- CCT-1668 (CCT1CPU)
- MAC-6400
- CXS-0424
These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
slican	cct-1668	< 6.56.0430	6.56.0430
slican	cxs-0424	< 6.30.0510	6.30.0510
slican	ipx	< 6.61.0040	6.61.0040
slican	mac-6400	< 6.56.0430	6.56.0430

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1391